AvantGuard - SentinelOne

Actions682

Overview

This node performs the 'Abort Scan' action on SentinelOne agents via the web API. It allows users to specify a detailed filter to select which agents should have their ongoing scans aborted. This is useful in scenarios where scans need to be stopped on certain agents based on complex criteria such as agent version, operating system, location, or threat status. For example, an administrator can abort scans on all Linux agents with a specific version or those located in certain sites.

Properties

Name	Meaning
Filter	A JSON object defining criteria to select agents whose scans will be aborted. Only agents matching this filter will be affected. Leaving it empty applies the action to all applicable agents.
Additional Body Fields	Optional additional JSON fields to include in the request body, allowing for extended customization of the abort scan action.

Output

JSON

response - The JSON response from the SentinelOne API after attempting to abort scans on the filtered agents. It typically contains status information about the action's success or failure.

Dependencies

Requires an API key credential for the AvantGuard SentinelOne API to authenticate requests.
Depends on the '@avantguardllc/n8n-openapi-node' package for OpenAPI integration.

Troubleshooting

If the filter JSON is malformed, the node may fail to send the request. Ensure the filter is valid JSON.
If no agents match the filter, the API may return an empty or error response; verify filter criteria.
Authentication errors may occur if the API key credential is missing or invalid; check credentials configuration.
Network or API endpoint issues can cause request failures; verify the base URL and network connectivity.
Unexpected API responses may require checking the SentinelOne API documentation for changes or limitations.