Overview

This node interacts with the SentinelOne Management Console API to check if a user has permission to run a Remote Shell session on endpoints. Remote Shell provides full shell capabilities (PowerShell on Windows, Bash on macOS and Linux) for remote response to events on endpoints. The node is useful for administrators who need to verify Remote Shell permissions for users or API tokens before attempting to start a Remote Shell session.

Use Case Examples

1. Check if a specific user or API token has permission to run Remote Shell on endpoints.
2. Verify Remote Shell permissions for your own user account or for other users in your SentinelOne deployment.

Properties

Output

JSON

• json
  • debug - Debug information including URL, query parameters, headers, and body sent with the API request (if debug is enabled)

Dependencies

• An API key credential for SentinelOne Management Console authentication

Troubleshooting

• Ensure the API credentials are valid and have appropriate permissions for Remote Shell operations.
• If the node returns permission denied, verify the user role includes Remote Shell permissions (Admin, SOC, IR Team) and the Control SKU is enabled.
• Use the debug option to inspect the actual API request and response for troubleshooting.

Links

• SentinelOne Remote Shell Documentation - Official documentation on Remote Shell permissions and usage in SentinelOne.