SentinelOne XSPM Vulnerability Management

Overview

Vulnerabilities in SentinelOne are tracked through the Extended Security Posture Management (XSPM) module. The platform identifies CVEs across managed endpoints, cloud workloads, and applications, enriching them with EPSS (Exploit Prediction Scoring System) scores, exploit maturity data, and remediation guidance. For MSPs, vulnerability management is a core service -- tracking which client endpoints have unpatched critical CVEs, prioritizing patches based on exploit likelihood, and reporting on vulnerability posture during quarterly business reviews.

All vulnerability tools are read-only. You can view, search, and report on vulnerabilities, but you cannot change vulnerability status, apply patches, or take remediation actions through the MCP tools.

MCP Tools

Available Tools

List Vulnerabilities

Call list_vulnerabilities with optional parameters:

• Filter by severity: Set severity to CRITICAL, HIGH, MEDIUM, LOW, or INFO
• Filter by status: Set status to one of the allowed values (see Status Values below)
• Sort results: Set sortBy (e.g., severity, epssScore, detectedAt) and sortOrder (ASC or DESC)
• Paginate: Set limit and use cursor from the response for subsequent pages

Example: List all critical vulnerabilities:

• list_vulnerabilities with severity=CRITICAL, sortBy=epssScore, sortOrder=DESC

Example: List vulnerabilities awaiting patches:

• list_vulnerabilities with status=TO_BE_PATCHED, limit=50

Search Vulnerabilities

Call search_vulnerabilities with a filters array for complex queries:

Example: Search for a specific CVE:

• search_vulnerabilities with filters=[{"fieldId": "cveId", "filterType": "EQUALS", "values": ["CVE-2024-1234"]}]

Example: Search for exploitable vulnerabilities:

• search_vulnerabilities with filters=[{"fieldId": "exploitMaturity", "filterType": "EQUALS", "values": ["ACTIVE"]}]

Get Vulnerability Details

Call get_vulnerability with the vulnerabilityId to retrieve full details including CVE information, EPSS score, affected assets, and remediation guidance.

Get Vulnerability Notes

Call get_vulnerability_notes with the vulnerabilityId to retrieve analyst comments and tracking notes.

Get Vulnerability History

Call get_vulnerability_history with the vulnerabilityId to retrieve the timeline of status changes and updates.

Key Concepts

Vulnerability Status Values

Severity Levels

EPSS Scores

The Exploit Prediction Scoring System (EPSS) provides a probability score (0.0 to 1.0) indicating how likely a vulnerability is to be exploited in the next 30 days:

Exploit Maturity

GraphQL Filter Syntax

Search tools use GraphQL filters:

{
  "fieldId": "severity",
  "filterType": "EQUALS",
  "values": ["CRITICAL"]
}

Common filter fields: cveId, severity, status, epssScore, exploitMaturity, siteName, endpointName, applicationName, detectedAt.

Field Reference

Core Vulnerability Fields

Common Workflows

Critical Vulnerability Review

1. Call list_vulnerabilities with severity=CRITICAL, status=NEW, sortBy=epssScore, sortOrder=DESC
2. Review each vulnerability's EPSS score and exploit maturity
3. For high-EPSS vulnerabilities, call get_vulnerability for full details
4. Group by client (siteName) to identify which clients are most exposed
5. Prioritize remediation based on EPSS score and exploit maturity

Vulnerability Audit by Client

1. Call search_vulnerabilities with filters=[{"fieldId": "siteName", "filterType": "EQUALS", "values": ["Client Name"]}]
2. Aggregate by severity: count CRITICAL, HIGH, MEDIUM, LOW
3. Identify top CVEs by EPSS score
4. Check for any actively exploited vulnerabilities (exploitMaturity=ACTIVE)
5. Generate a client-specific vulnerability report

Patch Prioritization

1. Call list_vulnerabilities with status=TO_BE_PATCHED, sortBy=epssScore, sortOrder=DESC
2. Focus on vulnerabilities with exploitMaturity of ACTIVE or WEAPONIZED
3. Group by application to identify which patches address the most vulnerabilities
4. Generate a prioritized patch list by client

Vulnerability Trending

1. Call list_vulnerabilities for the current period
2. Compare with previous period to identify new vulnerabilities
3. Calculate remediation rates (resolved / total)
4. Track EPSS score distribution changes
5. Report on vulnerability posture improvement or degradation

QBR Vulnerability Report

1. Call search_vulnerabilities filtered by client site
2. Count by severity and status
3. Highlight CRITICAL and HIGH with ACTIVE exploit maturity
4. Show remediation progress (resolved vs. new over the period)
5. List top