Overview

This node interacts with the SentinelOne API to fetch the installed applications data for agents. Specifically, it supports the operation to request all agents to update the data of applications installed on their endpoints, which is useful for Application Risk Management. Users can specify filters to target specific agents and configure options such as custom request body, headers, query filters, batching, pagination, debug mode, and timeout. This node is beneficial for security teams monitoring application risks and vulnerabilities across endpoints managed by SentinelOne.

Use Case Examples

1. Trigger all agents to update their installed applications data to monitor application risks and vulnerabilities.
2. Fetch detailed installed application data for specific agents filtered by criteria such as agent IDs or OS types.

Properties

Output

JSON

• json
  • debug - Debug information including URL, query parameters, headers, and body sent with the API request, if debug mode is enabled.

Dependencies

• An API key credential for SentinelOne API authentication.

Troubleshooting

• Ensure the SentinelOne API credentials are correctly configured and have the necessary permissions to perform the fetch installed apps action.
• Check that the required filter fields are provided in the request body as some fields are mandatory for this operation.
• If the API request fails, enable debug mode to inspect the actual request details and response for troubleshooting.
• Be aware of rate limits and use batching and batch interval options to avoid hitting API rate limits.

Links

• SentinelOne API Documentation - Fetch Installed Apps - Official API documentation for the fetch installed apps action on agents.