AvantGuard - SentinelOne icon

AvantGuard - SentinelOne

AvantGuard - SentinelOne

Actions682

Overview

This node performs tag management actions on agents within the AvantGuard SentinelOne platform via its Web API. Specifically, it allows users to add or remove tags on agents that match a given filter criteria. This is useful for organizing, categorizing, or managing agents in bulk based on dynamic conditions such as OS version, agent version, location, or other attributes. For example, a user can add a 'monitored' tag to all Linux agents running a specific agent version or remove a tag from agents that are decommissioned.

Properties

Name Meaning
Data Specifies the tags to attach or detach from the matched agents. Each tag entry includes a tag ID and an operation (e.g., 'add' or 'remove'). This property is required and expects a JSON array.
Filter Defines the criteria to select which agents will be affected by the tag management action. This is a JSON object containing various filtering fields such as agent version, OS type, location IDs, and many others. Only agents matching this filter will have the tag operations applied. Leaving this empty applies the action to all applicable agents.

Output

JSON

  • success - Indicates whether the tag management operation was successful.
  • affectedAgentCount - Number of agents that matched the filter and were affected by the tag operation.
  • details - Additional information or messages returned by the API about the operation.

Dependencies

  • Requires an API key credential for AvantGuard SentinelOne API authentication.
  • Relies on the AvantGuard SentinelOne Web API endpoint specified in the node credentials.

Troubleshooting

  • If the node returns authentication errors, verify that the API key credential is correctly configured and has sufficient permissions.
  • Malformed JSON in the 'Data' or 'Filter' properties can cause parsing errors; ensure valid JSON syntax.
  • If no agents are affected, check that the filter criteria correctly match existing agents.
  • Network or API endpoint issues may cause request failures; verify connectivity and base URL configuration.
  • API rate limits or permission restrictions may result in partial or failed operations.

Discussion