SentinelOne icon

SentinelOne

SentinelOne Management Console API specification.

Actions281

Agents → Get Agents

AI-generated

Overview

This node interacts with the SentinelOne Management Console API to retrieve information about Agents based on various filters and options. It supports fetching all agents or a single page of results, with extensive filtering capabilities such as filtering by K8S node name, CPU core count, Ranger status, Active Directory queries, threat status, operating system types, and many more. This node is useful for security administrators who need to query and manage endpoint agents in their SentinelOne environment, for example, to monitor agent status, perform audits, or prepare for targeted actions on specific agents.

Use Case Examples

  1. Retrieve all agents with a specific Active Directory computer name filter to monitor endpoint compliance.
  2. Fetch a single page of agents that have active threats and are running a specific OS version for incident response.
  3. Get all agents that are up to date and have a certain mitigation mode policy for maintenance planning.

Properties

Name Meaning
Return All Whether to return all results or only a single page. When disabled, no pagination parameters are sent and only one page of results is returned.
Additional Fields Various optional filters to narrow down the list of agents, such as K8S node name, CPU core count, Ranger statuses, Active Directory queries, threat creation dates, decommissioned status, operational states, vulnerability statuses, mitigation modes, creation and update timestamps, network and cloud attributes, and many more.

Output

JSON

  • json - The JSON response containing the list of agents and their details.

Dependencies

  • an API key credential for SentinelOne API authentication

Troubleshooting

  • Ensure the API credentials are correctly configured and have the necessary permissions to access agent data.
  • Check the network connectivity to the SentinelOne Management Console API endpoint.
  • Verify that the filters and parameters used are valid and supported by the API.
  • If pagination is enabled, ensure the pagination settings are correctly configured to avoid incomplete data retrieval.
  • Enable debug mode to inspect the actual API requests and responses for troubleshooting.

Links

Discussion