Export SentinelOne Watchlist Queries with PowerShell.

SentinelOne_Export_Watchlist_Queries.ps1

<#
Update the console_address with your subdomain, change the query limit on the filters_api if you wish, and update the
YOUR_API_TOKEN with a token that has the correct API permissions.

$json is the pure json results off the API, but the script will convert the json and export to csv.

You can do this within your console from the API Doc page. Just navigate to Filters > Get Deep Visibility Filters. 
Change your limit and run from console to get the json output.
https://YOUR_CONSOLE.sentinelone.net/api-doc/api-details?category=filters&api=get-deep-visibility-filters
#>

$console_address = "https://YOUR_CONSOLE.sentinelone.net"
$filters_api = $console_address + "/web/api/v2.1/filters/dv?limit=300"

$headers = @{"Authorization" = "APIToken YOUR_API_TOKEN"; "Content-Type" = "application/json"}

$request = Invoke-WebRequest -Uri $filters_api -Headers $headers
$Json = $request.Content | ConvertFrom-Json
$Json.data | Export-CSV DVWatchlist_Queries.csv -NoClobber -NoTypeInformation