AvantGuard - SentinelOne

Actions682

Overview

This node performs a POST request to the SentinelOne API to fetch files associated with a specific agent by its Agent ID. It is useful in scenarios where you need to retrieve files from an endpoint agent for analysis, investigation, or backup purposes. For example, a security analyst can use this node to request specific files from a compromised agent to examine potential malware or data exfiltration.

Properties

Name	Meaning
Agent Id	The unique identifier of the agent from which files will be fetched. This is required to specify the target agent for the file retrieval operation.
Data	A JSON object containing the request payload, including sensitive information like a password and an array of file paths to fetch from the agent. This data is sent in the body of the POST request to the API.

Output

JSON

response - The JSON response from the SentinelOne API containing the result of the fetch files operation, such as status, file data, or error messages.

Dependencies

Requires an API key credential for the AvantGuard SentinelOne API, including a base URL and authentication token.

Troubleshooting

Ensure the Agent Id is correct and corresponds to an existing agent in SentinelOne; otherwise, the API will return an error or empty result.
Verify that the 'Data' JSON is correctly formatted and includes all required fields such as 'password' and 'files' array; malformed JSON or missing fields will cause request failures.
Check that the API credentials are valid and have sufficient permissions to perform file fetch operations on the specified agent.
Common errors include authentication failures, invalid agent ID, or insufficient permissions. Review the API response message for details and adjust inputs or credentials accordingly.