Overview

The SentinelOne node's 'Initiate Scan' action triggers a Full Disk Scan on selected agents that match specified filters. This scan detects dormant suspicious activities, threats, and compliance violations on the local file system of the endpoints. It is useful for security teams to proactively identify hidden threats and ensure endpoint compliance. The scan excludes network or external drives requiring user credentials and does not perform hash-based blacklist checks on all files, but integrates with Static AI and cloud data for enhanced detection.

Use Case Examples

1. Run a Full Disk Scan on all Windows agents in a specific group to detect dormant threats.
2. Initiate a scan on a subset of agents filtered by OS type and threat status to ensure compliance.

Properties

Output

JSON

• json
  • debug - Debug information including URL, query parameters, headers, and body sent with the API request (if debug is enabled)

Dependencies

• An API key credential for SentinelOne Management Console API

Troubleshooting

• Ensure the API credentials are valid and have permissions to initiate scans on agents.
• Check network connectivity to the SentinelOne Management Console API endpoint.
• If the scan does not start, verify that the agent filters are correctly specified and match existing agents.
• Enable debug mode to get detailed request and response information for troubleshooting.

Links

• SentinelOne API - Initiate Scan - Official API documentation for the Initiate Scan action on agents.