Overview

This node operation checks if a specified user has permission to run Remote Shell on SentinelOne Agents. Remote Shell allows opening a full shell session (PowerShell on Windows, Bash on macOS/Linux) for remote endpoint management and incident response. This operation is useful for administrators to verify user permissions before attempting to start a Remote Shell session, ensuring compliance with security policies.

Use Case Examples

1. Check if a user has permission to run Remote Shell before initiating a session to avoid unauthorized access.
2. Verify Remote Shell permissions for API users or service accounts to manage endpoint security remotely.

Properties

Output

JSON

• json
  • debug - Debug information including URL, query parameters, headers, and body sent with the API request (if debug is enabled)

Dependencies

• An API key credential for SentinelOne Management Console API

Troubleshooting

• Ensure the API credentials have sufficient permissions to query Remote Shell permissions.
• If the API returns permission denied, verify the user role includes Remote Shell access (Admin, SOC, IR Team).
• Check that the Control SKU is enabled in the SentinelOne deployment, as Remote Shell requires it.
• Enable debug mode to see the full request and response details for troubleshooting.

Links

• SentinelOne API Documentation - Can Start Remote Shell - Official API documentation for the 'can-start-remote-shell' endpoint used to check Remote Shell permissions.