AvantGuard - SentinelOne

Actions682

Overview

This node performs the 'Ranger Disable' action on SentinelOne agents filtered by specific criteria. It allows users to specify a detailed JSON filter to select which agents the action applies to, enabling targeted disabling of the Ranger feature on those agents. This is useful in scenarios where administrators need to disable Ranger on a subset of agents based on attributes like OS version, agent version, location, tags, or other metadata. For example, disabling Ranger on all Linux agents with a certain agent version or within specific locations.

Properties

Name	Meaning
Filter	A JSON object defining criteria to filter agents. Only agents matching this filter will be affected by the Ranger Disable action. If left empty, the action applies to all applicable agents.
Additional Body Fields	Optional additional JSON fields to include in the request body, allowing customization or extension of the action's payload.

Output

JSON

response - The JSON response from the SentinelOne API after performing the Ranger Disable action, typically containing status or result details.

Dependencies

Requires an API key credential for AvantGuard SentinelOne API authentication.
Depends on the '@avantguardllc/n8n-openapi-node' package for OpenAPI integration.

Troubleshooting

If the filter JSON is malformed, the node will fail to parse it, resulting in an error. Ensure the filter is valid JSON.
If no agents match the filter criteria, the action will have no effect; verify filter correctness.
Authentication errors may occur if the API key credential is missing or invalid; verify credentials configuration.
Network or API endpoint errors can happen if the baseURL credential is incorrect or the SentinelOne API is unreachable.