SentinelOne icon

SentinelOne

SentinelOne Management Console API specification.

Actions281

Activities → Get Activities

AI-generated

Overview

This node interacts with the SentinelOne Management Console API to retrieve activity records based on specified filters and options. It is useful for monitoring and auditing activities within the SentinelOne environment, such as tracking user actions, agent activities, and system events. Users can filter activities by various criteria like creation time, agent IDs, activity types, user IDs, and more. The node supports pagination and can return all matching results or a single page, making it suitable for both quick checks and comprehensive data retrieval.

Use Case Examples

  1. Retrieve all activities related to specific agents within a certain time range for audit purposes.
  2. Fetch activities filtered by activity types and user emails to monitor specific user actions.
  3. Get a limited number of recent activities sorted by creation date for quick status checks.

Properties

Name Meaning
Return All Whether to return all results or only a single page. When disabled, no pagination parameters are sent and only one page of results is returned.
Additional Fields Optional filters to narrow down the activities returned, such as creation timestamps, agent IDs, activity types, user IDs, site IDs, and more.

Output

JSON

  • id - Activity ID
  • type - Activity type code
  • createdAt - Timestamp when the activity was created
  • agentId - ID of the related agent
  • userId - ID of the user who invoked the activity
  • siteId - ID of the related site
  • groupId - ID of the related group
  • accountId - ID of the related account
  • ruleId - ID of the related rule
  • alertId - ID of the related alert
  • threatId - ID of the related threat
  • details - Additional details about the activity

Dependencies

  • an API key credential for SentinelOne

Troubleshooting

  • Ensure the API credentials are correctly configured and have the necessary permissions to access activities.
  • Check that the filter parameters are valid and correctly formatted, especially date-time strings and comma-separated lists.
  • If pagination is enabled, verify that the pagination settings match the API's expected parameters.
  • Enable debug mode to see the actual API request and response for troubleshooting.

Links

Discussion