Overview

The SentinelOne node's 'Fetch Firewall Logs' action enables users to retrieve Firewall Control event logs from endpoints with Firewall Control enabled. This is useful for monitoring and analyzing firewall activity, such as blocked traffic events, which can be logged locally on the endpoint or also reported to the management console. It supports filtering which agents to fetch logs from and allows customization of request headers, query parameters, batching, pagination, and timeout settings. This action is particularly beneficial for security teams needing detailed firewall event data for threat analysis and compliance auditing.

Use Case Examples

1. Fetch firewall logs from all agents in a specific group to analyze blocked traffic events locally on endpoints.
2. Enable firewall logging for selected agents and retrieve the logs to monitor suspicious network activity.

Properties

Output

JSON

• json - Response data from the API call, including firewall logs and optionally debug information if enabled.

Dependencies

• An API key credential for SentinelOne Management Console API

Troubleshooting

• Ensure the API credentials are correctly configured and have necessary permissions to access Firewall Control logs.
• Check that Firewall Control is enabled on the target agents and that the agents are online and reachable.
• If using batching, verify batch size and interval settings to avoid rate limiting errors.
• Enable debug mode to get detailed request and response information for troubleshooting.

Links

• SentinelOne API Documentation - Fetch Firewall Logs - Official API documentation for the Fetch Firewall Logs action in SentinelOne Management Console API.