Figure’d I’d drop this here.
Worked with someone that wanted a daily email that gives a 24 hour snapshot of new investigations, alerts, vulnerabilities, and for them they wanted SentinelOne agent status. At the end of the workflow it whips up an HTML and is setup to connect to a step for emailing, or even sending a message in slack or teams. Feel free to grab it and play around. Works specifically for folks with IDR, IVM, and Surface Command. You could get most of this without Surface Command I think.