Overview

This node operation disconnects agents from the network based on specified threat filters. It is useful in scenarios where endpoints need to be isolated to prevent the spread of threats while still allowing communication with the management console for analysis and mitigation. For example, in a security incident response, an administrator can use this operation to quarantine infected endpoints immediately.

Use Case Examples

1. Isolate endpoints infected with a specific malware by disconnecting their agents from the network to contain the threat.
2. Quarantine all agents associated with a particular threat to prevent lateral movement within the network.

Properties

Output

JSON

• json
  • debug - Debug information including URL, query parameters, headers, and body sent with the API request (if debug is enabled)

Dependencies

• An API key credential for SentinelOne Management Console API

Troubleshooting

• Ensure the API credentials are correctly configured and have the necessary permissions to disconnect agents.
• Check that the input data and filters are correctly set to target the intended agents.
• If the API returns permission errors, verify the user role has Admin, IR Team, or SOC permissions for disconnecting agents.
• Enable debug mode to get detailed request and response information for troubleshooting.
• Be aware of rate limits and use batching and intervals to avoid hitting them.

Links

• SentinelOne API Documentation - Disconnect Agents - Official API documentation for the Disconnect Agents operation in SentinelOne.