/misconfigurations

name: "SentinelOne Misconfigurations"
description: >
  Cloud security posture findings from SentinelOne's XSPM module across AWS, Azure,
  GCP, Kubernetes, identity providers, and infrastructure-as-code. Covers the
  read-only misconfiguration tools, view types, severity and status values,
  compliance-standard and MITRE ATT&CK mappings, evidence fields, and remediation
  guidance.
when_to_use: >-
  When reviewing or reporting on a client's cloud security posture and open
  misconfigurations. Use when:
  sentinelone misconfiguration, sentinelone posture, sentinelone compliance, sentinelone cspm,
  cloud security posture, sentinelone cloud security, sentinelone kubernetes security, sentinelone
  identity security, sentinelone iac, misconfiguration review, compliance audit, or security
  posture.

SentinelOne XSPM Cloud Security Posture Management

Overview

Misconfigurations in SentinelOne are tracked through the Extended Security Posture Management (XSPM) module. The platform detects security configuration gaps across cloud environments (AWS, Azure, GCP), Kubernetes clusters, identity providers (Active Directory, Entra ID), and infrastructure-as-code templates. Each misconfiguration includes compliance standard mappings, MITRE ATT&CK technique mappings, remediation steps, and evidence showing the specific resource, file, IP, port, or secret involved.

For MSPs, misconfiguration detection is essential for maintaining client security posture -- identifying exposed S3 buckets, overly permissive firewall rules, unrotated service account keys, and Kubernetes workloads running as root. These findings directly support compliance audits and QBR security reporting.

All misconfiguration tools are **read-only**. You can view, search, and report on misconfigurations, but you cannot remediate them through the MCP tools.

Anti-triggers

• **A missing patch rather than a bad setting.** CVEs share this skill's

severity/status/notes/history shape and the same XSPM module — use `sentinelone-vulnerabilities`.

• **M365 tenant baseline drift.** "Compliance" and "posture" here mean

cloud and Kubernetes resource configuration. Conditional Access, secure-score, and standards-template drift across managed M365 tenants are `cipp-standards`; mailbox and identity settings are `m365-security`.

• **An active detection.** A misconfiguration is a standing weakness, not

an event — for something that fired, use `sentinelone-alerts`.

MCP Tools

Available Tools

| Tool | Description | Key Parameters | |------|-------------|----------------| | `get_misconfiguration` | Get a single misconfiguration by ID | `misconfigurationId` (required) | | `list_misconfigurations` | List misconfigurations with filters | `severity`, `status`, `viewType`, `limit`, `cursor`, `sortBy`, `sortOrder` | | `search_misconfigurations` | Search misconfigurations with GraphQL filters | `filters` (array of fieldId/filterType/values), `limit`, `cursor` | | `get_misconfiguration_notes` | Get notes on a misconfiguration | `misconfigurationId` (required) | | `get_misconfiguration_history` | Get timeline of changes for a misconfiguration | `misconfigurationId` (required) |

List Misconfigurations

Call `list_misconfigurations` with optional parameters:

• **Filter by severity:** Set `severity` to `CRITICAL`, `HIGH`, `MEDIUM`, `LOW`, or `INFO`
• **Filter by status:** Set `status` to `NEW`, `IN_PROGRESS`, `RESOLVED`, `RISK_ACKED`, or `SUPPRESSED`
• **Filter by view type:** Set `viewType` to scope the detection domain (see View Types below)
• **Sort results:** Set `sortBy` and `sortOrder`
• **Paginate:** Set `limit` and use `cursor` for subsequent pages

**Example: List critical cloud misconfigurations:**

• `list_misconfigurations` with `severity=CRITICAL`, `viewType=CLOUD`, `sortOrder=DESC`

**Example: List Kubernetes misconfigurations:**

• `list_misconfigurations` with `viewType=KUBERNETES`, `limit=50`

Search Misconfigurations

Call `search_misconfigurations` with a `filters` array:

**Example: Search for misconfigurations in a client's environment:**

• `search_misconfigurations` with `filters=[{"fieldId": "siteName", "filterType": "EQUALS", "values": ["Acme Corporation"]}]`

**Example: Search for a specific compliance standard:**

• `search_misconfigurations` with `filters=[{"fieldId": "complianceStandard", "filterType": "CONTAINS", "values": ["CIS"]}]`

Get Misconfiguration Details

Call `get_misconfiguration` with the `misconfigurationId` to retrieve full details including compliance mappings, evidence, and remediation steps.

Get Misconfiguration Notes

Call `get_misconfiguration_notes` with the `misconfigurationId` to retrieve analyst comments and tracking notes.

Get Misconfiguration History

Call `get_misconfiguration_history` with the `misconfigurationId` to retrieve the timeline of status changes and updates.

Key Concepts

View Types

| View Type | Description | Example Findings | |-----------|-------------|------------------| | `CLOUD` | Cloud infrastructure (AWS, Azure, GCP) | Public S3 buckets, open security groups, unencrypted storage | | `KUBERNETES` | Kubernetes clusters and workloads | Containers running as root, missing network policies, exposed dashboards | | `IDENTITY` | Identity providers (AD, Entra ID) | Stale accounts, excessive permissions, missing MFA | | `INFRASTRUCTURE_AS_CODE` | IaC templates (Terraform, CloudFormation) | Hardcoded secrets, missing encryption, overly permissive policies | | `ADMISSION_CONTROLLER` | Kubernetes admission policies | Policy violations in pod deployments | | `SECRET_SCANNING` | Exposed secrets and credentials | API keys in code, hardcoded passwords, leaked tokens |

Compliance Standards

Misconfigurations are mapped to industry compliance standards:

| Standard | Description | |----------|-------------| | CIS Benchmarks | Center for Internet Security configuration benchmarks | | SOC 2 | Service Organization Control Type 2 | | PCI DSS |