AvantGuard - SentinelOne

Actions682

Overview

This node operation queries the AvantGuard SentinelOne Datalake Inventory Workstation API to retrieve available actions with status for XDR assets on workstations. It allows users to specify a wide range of optional query and body parameters to filter and customize the request, enabling detailed asset management and monitoring within security workflows. Typical use cases include fetching actionable insights on workstation assets, filtering assets by various criteria such as OS version, agent status, tags, and more, to automate security response or inventory management.

Properties

Name	Meaning
Additional Query Parameters	Optional query parameters to filter and refine the asset data returned by the API, such as OS version, agent status, tags, serial number, network info, and many other asset attributes.
Additional Body Fields	Optional body fields to further filter the request payload, including lists of inventory IDs to include or exclude.

Output

JSON

actions - List of available actions with status for the filtered workstation assets returned by the API.
status - Status information related to the request or the assets.
metadata - Additional metadata about the response, such as pagination or counts.

Dependencies

Requires AvantGuard SentinelOne API credentials including base URL and API key for authentication.

Troubleshooting

Ensure that the API credentials are correctly configured and have sufficient permissions to access the Datalake Inventory Workstation API.
Verify that the query and body parameters are correctly formatted, especially JSON arrays and date ranges, to avoid request errors.
If the response is empty or missing expected data, check the filter parameters to ensure they are not overly restrictive.
Network connectivity issues or incorrect base URL configuration can cause request failures; verify network access and credential settings.
API rate limits or quota restrictions may cause errors; monitor usage and adjust accordingly.