Overview

The SentinelOne node's 'Fetch Logs' action allows users to retrieve Agent and Endpoint logs from SentinelOne Agents that match specified filters. This is particularly useful for security analysts and IT administrators who need to access detailed logs for troubleshooting, incident investigation, or compliance auditing. The node supports customization of request parameters including custom request body, headers, query filters, batching, pagination, and timeout settings. It also offers a debug mode to include detailed request information in the output for troubleshooting purposes.

Use Case Examples

1. Fetch logs from all Agents in a specific group to analyze recent security events.
2. Retrieve Endpoint logs for Windows machines with a specific Agent version for compliance auditing.

Properties

Output

JSON

• json
  • debug - Debug information including URL, query parameters, headers, and body sent with the API request (if debug is enabled)

Dependencies

• An API key credential for SentinelOne API authentication

Troubleshooting

• Ensure the API credentials are correctly configured and have the necessary permissions to fetch logs.
• Check network connectivity to the SentinelOne Management Console API endpoint.
• If using batching, verify batch size and interval to avoid rate limiting errors.
• Enable debug mode to get detailed request and response information for troubleshooting.

Links

• SentinelOne API Documentation - Fetch Logs - Official API documentation for the fetch logs action in SentinelOne.