AvantGuard - SentinelOne

Actions682

Overview

This node operation deletes custom detection rules in the AvantGuard SentinelOne system via its Web API. It allows users to specify complex filters to select which detection rules to delete, such as by status, creator, description, query type, scopes, group IDs, expiration mode, names, and various IDs. This is useful for automating cleanup or management of detection rules in security monitoring workflows.

Properties

Name	Meaning
Filter	A JSON object defining criteria to select which custom detection rules to delete. It supports filtering by multiple fields such as status, creator, description, query type, scopes, group IDs, expiration mode, name, S1QL query content, account IDs, site IDs, and rule IDs.

Output

JSON

response - The JSON response from the AvantGuard SentinelOne API after attempting to delete the specified custom detection rules. It typically contains status information about the deletion operation.

Dependencies

AvantGuard SentinelOne API
An API key credential for authentication with the AvantGuard SentinelOne service

Troubleshooting

If the filter JSON is malformed or missing required fields, the API may reject the request. Ensure the filter JSON is valid and matches the expected schema.
Authentication errors may occur if the API key credential is missing or invalid. Verify that the credential is correctly configured.
If no detection rules match the filter criteria, the API may return an empty result or a message indicating no rules were deleted.
Network or connectivity issues with the AvantGuard SentinelOne API endpoint can cause request failures. Check network access and base URL configuration.