AvantGuard - SentinelOne

Actions682

Overview

This node operation retrieves activity records from the AvantGuard SentinelOne system via its Web API. It allows users to fetch detailed activity logs filtered by various criteria such as activity types, user IDs, timestamps, and related entities like alerts or threats. This is useful for security analysts or system administrators who want to monitor, audit, or investigate activities within their SentinelOne environment. For example, one could fetch all activities related to a specific threat or within a certain time range to analyze security events.

Properties

Name	Meaning
Additional Query Parameters	Optional filters and parameters to customize the activity retrieval query, such as filtering by activity types, user IDs, timestamps, sorting options, and pagination controls.

Output

JSON

activities - Array of activity objects returned by the API matching the query parameters.
totalCount - Total number of activities matching the query, if count is requested or available.
cursor - Cursor token for fetching the next page of results if pagination is used.

Dependencies

Requires an API key credential for AvantGuard SentinelOne API access.
Depends on the '@avantguardllc/n8n-openapi-node' package for OpenAPI integration.

Troubleshooting

If the node returns authentication errors, verify that the API key credential is correctly configured and has sufficient permissions.
If no activities are returned, check the filter parameters for correctness and ensure that matching activities exist in the SentinelOne system.
Pagination parameters like 'cursor' and 'skip' must be used carefully to avoid missing or duplicating data when iterating over large datasets.
Using 'countOnly' with other filters can help quickly check the number of matching activities without fetching full data.
Ensure date/time filters use the correct ISO 8601 format to avoid query errors.