Actions281
- Accounts Actions
- Account Policy
- Update Account Policy
- GenerateRegenerate Uninstall Password
- Get Uninstall Password Metadata
- Revoke Uninstall Password
- Get Uninstall Password
- Get Account by ID
- Update Account
- Expire an Account
- Reactivate Account
- Revert Policy
- Get Accounts
- Create Account
- Get accounts private
- Available Name
- Get Accounts for Navigation
- Get One Account
- Policy Actions
- UninstallPassword Actions
- Activities Actions
- Agents Actions
- Abort Scan
- Approve Uninstall
- Broadcast Message
- Can run Remote Shell
- Clear Remote Shell
- Connect to Network
- Decommission
- Disable Agent
- Disconnect from Network
- Enable Agent
- Fetch Firewall Rules
- Get Installed Apps for agent
- Initiate Scan
- Mark as uptodate
- Move to Console
- Move between Sites
- Randomize UUID
- Disable Ranger
- Enable Ranger
- Reject uninstall
- Reset Local Config
- Set Persistent Configuration Overrides
- Set External ID
- Shutdown
- Start Remote Profiling
- Start Remote Shell
- Stop Remote Profiling
- Uninstall
- Update Software
- Fetch Files
- Export Agent Logs
- Get Agents
- Get Application
- Count Agents
- Get Passphrase
- Processes
- DEPRECATED Get Agent Available Actions
- Get Agent Available Actions
- Event Throttling
- Flush Event Queue
- Protect
- Purge Crash Dumps
- Purge DB
- Purge Research Data
- Reload
- Restart
- Revoke Token
- Send Crash Dumps
- Send Research Data
- Unprotect
- Randomize DV Host
- Auto Complete
- Count by Filters
- FreeText Filters
- Count Summary
- Get config
- Actions Actions
- Abort Scan
- Approve Uninstall
- Broadcast Message
- Can run Remote Shell
- Clear Remote Shell
- Connect to Network
- Decommission
- Disable Agent
- Disconnect from Network
- Enable Agent
- Fetch Firewall Rules
- Get Installed Apps for agent
- Fetch Logs
- Fetch Firewall Logs
- Initiate Scan
- Mark as uptodate
- Move to Console
- Move between Sites
- Randomize UUID
- Disable Ranger
- Enable Ranger
- Reject uninstall
- Reset Local Config
- Restart
- Set Persistent Configuration Overrides
- Set External ID
- Shutdown
- Settings Actions
- Tasks Actions
- Threats Actions
- Get Enriched Events
- Count Events by Type
- Get Process Event
- Prefetch events
- Get Timeline Limits
- Get Tree
- Threat Analysis
- Threat Appearances
- Connect Agents
- Disconnect Agents
- Get Threat Available Actions
- Create Slim Threat
- Add to Blacklist Deep Visibility
- Mark as Threat Deep Visibility
- Auto Complete
- Count by Filters
- FreeText Filters
- Create Deep Visibility Threat
- Multiple actions for Threats
- Threat Summary
- Get Timeline Categories
- Update Threat Note
- Delete Threat Note
- Get Threat Notes
- Download from cloud
- Get Events
- Get Threat Timeline
- Exclusion Options
- Get Threats
- Add to Blacklist
- Add to Exclusions
- Update Threat Analyst Verdict
- Disable Engines
- Export Threats
- Update Threat External Ticket ID
- Fetch Threat File
- Updated Threat Incident
- Mitigate Threats
- Export Mitigation Report
- Add Note to Multiple
- Explore Actions
- Users Actions
- iFrame Token Details
- Login by iFrame Token
- Get Token
- Revoke iFrame Token
- Disable 2FA
- Enable 2FA
- Auth App
- Sign EULA
- Auth Recovery Code
- Redirect to SSO
- Auth by SSO
- Login
- Login by API Token
- Login by Token
- Send Verification Email
- Validate Verification Token
- Email Verification
- Get User
- Update User
- Delete User
- API Token by User ID
- List users
- Create User
- API Token Details
- Change Password
- Bulk Delete Users
- Enable 2FA App
- Generate API Token
- Generate iFrame Token
- Generate Recovery Code
- Check Global User
- Details Actions
- DeviceReview Actions
- Rbac Actions
- Role Actions
- RemoteScripts Actions
- ReportTasks Actions
- Reports Actions
- ActiveDirectory Actions
- Microsoft Actions
- Notifications Actions
- Recipients Actions
- Sms Actions
- Smtp Actions
- Sso Actions
- Notes Actions
- Download Actions
- Packages Actions
- Update Actions
- Upload Actions
- Software Actions
- 2fa Actions
- Auth Actions
- Login Actions
- SsoSaml2 Actions
- Onboarding Actions
- ApplicationInventory Actions
- ApplicationInventoryCounts Actions
- LastActivityAsSyslog Actions
- Sentinelonerss Actions
- SiteWithAdmin Actions
- Tests Actions
- User Actions
Agents → Event Throttling
AI-generatedOverview
This node interacts with the SentinelOne Management Console API to perform the 'Event Throttling' operation on Agents. It allows users to control whether filtered Agents send OS events (such as threat alerts, on-access, system trace) to the Management Console and to set a duration for which these events stop being sent. This is useful for creating a clean, lightweight environment for troubleshooting issues as recommended by SentinelOne Support.
Use Case Examples
- Temporarily enable event throttling on a group of Agents to reduce noise during a troubleshooting session.
- Configure event throttling to pause event sending from specific Agents for a set period to analyze system behavior without interference.
Properties
| Name | Meaning |
|---|---|
| Options | Collection of optional settings to customize the API request, including custom request body, headers, query filters, batching, debug mode, pagination, and timeout. |
Output
JSON
jsondebug- Debug information including URL, query parameters, headers, and body sent with the API request (if debug option is enabled)
Dependencies
- An API key credential for SentinelOne Management Console API
Troubleshooting
- Ensure the API credentials are correctly configured and have the necessary permissions to perform event throttling on Agents.
- If the API request fails, check the debug output (enable the Debug option) to verify the request URL, headers, and body.
- Be aware that the SOC role does not have permissions to run the event throttling command; use an account with appropriate permissions.
Links
- SentinelOne API Documentation - Event Throttling - Official API documentation for the event throttling operation on Agents in SentinelOne.