SentinelOne icon

SentinelOne

SentinelOne Management Console API specification.

Actions281

Agents → Protect

AI-generated

Overview

This node enables the Anti-Tampering protection on SentinelOne Agents that match specified filters. It is used to protect agents from unauthorized changes or uninstallation, typically after they have been unprotected for maintenance or troubleshooting. This operation is useful in scenarios where you want to restore security controls on agents to prevent tampering.

Use Case Examples

  1. After running an 'unprotect' command on a set of agents for maintenance, use this node to 'protect' them again to re-enable Anti-Tampering.
  2. Enable Anti-Tampering on all agents in a specific group or site to ensure they are secured against unauthorized changes.

Properties

Name Meaning
Options Additional options to customize the API request, including custom request body, headers, query filters, batching, debug mode, pagination, and timeout settings.

Output

JSON

  • json
    • debug - Debug information including the actual URL, query parameters, headers, and body sent for the API request, if debug mode is enabled.

Dependencies

  • An API key credential for SentinelOne API authentication.

Troubleshooting

  • Ensure the API credentials are correctly configured and have the necessary permissions to perform the protect action on agents.
  • If the API request fails, check the debug output (enable Debug option) to see the exact request details and error messages.
  • Verify that the filters used to select agents are correct and match existing agents in the SentinelOne environment.
  • Be aware that this command does not affect Linux agents, so it will only apply to Windows and macOS agents.

Links

Discussion