SentinelOne icon

SentinelOne

SentinelOne Management Console API specification.

Actions281

Agents → Fetch Files

AI-generated

Overview

The SentinelOne node's 'Fetch Files' operation under the 'Agents' resource allows users to fetch files from specific endpoints managed by SentinelOne. This operation is useful for security analysts and IT administrators who need to collect files from endpoints for threat analysis or forensic investigation. Users specify the Agent ID and provide file pathnames and a password to securely retrieve files up to 10 MB each. The files are collected and uploaded to the SentinelOne Management Console, from where they can be downloaded for further examination.

Use Case Examples

  1. A security analyst wants to collect suspicious files from a compromised endpoint to analyze potential malware. They use the 'Fetch Files' operation with the Agent ID and specify the file paths to retrieve the files securely.
  2. An IT administrator needs to gather log files from multiple endpoints to troubleshoot an issue. They use the 'Fetch Files' operation to fetch the required files from each Agent by specifying their IDs and file paths.

Properties

Name Meaning
Agent Id The unique identifier of the SentinelOne Agent from which files will be fetched. This is a required field.
Options Additional optional settings including custom request body, custom headers, query filters, batching settings, debug mode, pagination settings, and request timeout. These options allow fine-tuning of the API request behavior.

Output

JSON

  • data - The response data from the SentinelOne API for the fetch files action, including details about the fetched files and operation status.
  • debug - Optional debug information including the actual URL, query parameters, headers, and body sent for the API request, useful for troubleshooting.

Dependencies

  • An API key credential for authenticating with the SentinelOne Management Console API.

Troubleshooting

  • Ensure the Agent ID is correct and the Agent is active and reachable.
  • Verify that the password provided meets the complexity requirements (at least 10 characters with a mix of upper and lower case letters, numbers, and symbols).
  • Check that the file paths specified do not contain unsupported characters like regular expressions or metacharacters.
  • If the API request fails, enable debug mode to get detailed request and response information for troubleshooting.
  • Be aware of API rate limits and use batching and request interval options to avoid hitting limits.
  • Ensure that the SentinelOne Management Console has the fetch files feature enabled, especially for FedRAMP-compliant or GovCloud environments, which may require a support ticket.

Links

Discussion