AvantGuard - SentinelOne icon

AvantGuard - SentinelOne

AvantGuard - SentinelOne

Actions682

Overview

This node performs a GET request to the Datalake Inventory Server's Web API to retrieve XDR (Extended Detection and Response) asset data. It allows users to query and filter assets based on a wide range of optional parameters such as cloud provider details, agent statuses, operating system info, network attributes, tags, and more. This node is useful for security analysts and IT administrators who want to programmatically fetch detailed asset inventory data for monitoring, reporting, or integration with other systems.

Properties

Name Meaning
Additional Query Parameters A collection of optional filters and query parameters to refine the asset data retrieval. These include filters on cloud provider organization, agent health and status, operating system details, network information, tags, asset criticality, and many other asset attributes. Users can specify values or ranges to narrow down the results.

Output

JSON

  • response - The JSON response from the Datalake Inventory Server API containing the list of XDR assets matching the query parameters. This includes asset details such as IDs, statuses, tags, network info, and other metadata.
  • count - If 'countOnly' is true, this field contains the total number of matching assets.
  • cursor - Cursor token for pagination to retrieve the next set of results if available.

Dependencies

  • Requires an API key credential for authentication to the AvantGuard SentinelOne API.
  • Relies on the '@avantguardllc/n8n-openapi-node' package for OpenAPI integration.

Troubleshooting

  • Ensure the API credentials (baseURL and API key) are correctly configured; authentication failures will prevent data retrieval.
  • The API may limit the number of items returned per request; use 'limit' and 'cursor' parameters to paginate through large datasets.
  • Incorrect or unsupported filter values may result in empty responses or errors; verify filter syntax and supported values.
  • If 'countOnly' is set to true, the response will not include asset details, only the count; adjust accordingly based on needs.
  • Network connectivity issues or API downtime can cause request failures; check network and API status.

Discussion