AvantGuard - SentinelOne

Actions682

Overview

This node operation queries the Datalake Inventory Cloud to retrieve available actions with status for XDR assets on cloud surfaces. It allows users to filter and refine the query using a wide range of optional query parameters and body fields related to asset properties, cloud provider details, Kubernetes clusters, tags, and more. This is useful for security analysts or cloud administrators who want to programmatically fetch actionable insights about cloud assets' security posture and status in an automated workflow.

Properties

Name	Meaning
Additional Query Parameters	A collection of optional query parameters to filter the assets by various attributes such as cloud provider organization, active coverage, virtual network ID, encryption type, tags, region, resource type, asset criticality, Kubernetes details, and many others. These parameters allow fine-grained filtering of the asset inventory.
Additional Body Fields	Optional body fields to further filter the request, including lists of inventory IDs to include or exclude.

Output

JSON

actions - List of available actions with status for the filtered XDR cloud assets.
metadata - Additional metadata about the query result such as counts or pagination info.

Dependencies

Requires an API key credential for authentication to the AvantGuard SentinelOne API.
Depends on the '@avantguardllc/n8n-openapi-node' package for OpenAPI integration.

Troubleshooting

Ensure the API credentials are correctly configured and have sufficient permissions to access the Datalake Inventory Cloud API.
Verify that the query parameters are correctly formatted JSON arrays or strings as expected by the API.
Large or complex queries may result in timeouts or performance issues; try simplifying filters or paginating results.
If the API returns errors about invalid parameters, check for typos or unsupported filter keys.
Network connectivity issues to the configured baseURL can cause request failures.