AvantGuard - SentinelOne

Actions682

Overview

This node performs a broadcast post action to multiple agents filtered by specific criteria within the 'Agent Actions' resource. It allows sending a JSON data payload as a message or command to all agents that match the provided complex filter conditions. This is useful for network administrators or security teams who want to send notifications, alerts, or commands to a targeted group of agents based on attributes like OS version, agent version, location, threat status, and many other detailed filters.

Properties

Name	Meaning
Data	The JSON payload containing the message or data to be broadcasted to the filtered agents. This is the content that the agents will receive.
Filter	A complex JSON object defining the criteria to select which agents will receive the broadcast. Only agents matching this filter will be affected by the action. Leaving it empty applies the action to all applicable agents.

Output

JSON

success - Indicates whether the broadcast post action was successfully executed.
affectedAgentsCount - Number of agents that matched the filter and were targeted by the broadcast.
message - Response message or status from the API after performing the broadcast.

Dependencies

Requires an API key credential for authentication to the AvantGuard SentinelOne API.
Depends on the '@avantguardllc/n8n-openapi-node' package for API interaction.
Needs the base URL of the AvantGuard SentinelOne API configured in credentials.

Troubleshooting

If the node fails, verify that the API credentials are correct and have sufficient permissions.
Ensure the filter JSON is well-formed and valid; malformed JSON will cause errors.
If no agents are affected, check that the filter criteria correctly match existing agents.
Network or connectivity issues to the API endpoint can cause request failures.
API rate limits or quota restrictions might cause the node to fail or throttle requests.