AvantGuard - SentinelOne

Actions682

Overview

This node operation retrieves cloud detection alerts from the AvantGuard SentinelOne API. It allows users to query and filter alerts based on a wide range of criteria such as alert IDs, severity, incident status, analyst verdict, creation and report timestamps, Kubernetes and container metadata, source process details, and more. This is useful for security analysts and automation workflows that need to fetch and process security alerts programmatically, for example, to monitor threat activity, integrate with incident response systems, or generate reports.

Properties

Name	Meaning
Additional Query Parameters	A collection of optional filters and parameters to customize the alert query. These include filters by source process hashes, container and Kubernetes metadata, timestamps, severity, incident status, analyst verdict, pagination controls, sorting options, and full-text search among others.

Output

JSON

alerts - Array of alert objects matching the query parameters.
totalCount - Total number of alerts matching the query (if count is requested).
cursor - Cursor string for pagination to fetch next set of alerts.

Dependencies

Requires AvantGuard SentinelOne API credentials (API key and base URL).
Uses '@avantguardllc/n8n-openapi-node' package for API interaction.

Troubleshooting

Invalid or missing API credentials will cause authentication errors. Ensure API key and base URL are correctly configured.
Using invalid filter values or unsupported query parameters may result in API errors or empty results.
Pagination parameters like 'cursor' and 'skip' must be used correctly to iterate over large result sets.
Setting 'disablePagination' to true may cause large data responses; ensure the system can handle the volume.
Date/time filters must be in proper ISO 8601 format to avoid parsing errors.
If 'countOnly' is true, the response will not include alert objects, only the total count.