AvantGuard - SentinelOne

Actions682

Overview

This node operation retrieves a list of exclusions from the AvantGuard SentinelOne API with extensive filtering capabilities. It is useful for security analysts or automation workflows that need to query and analyze exclusion rules applied in SentinelOne environments. For example, you can fetch exclusions filtered by creation date, exclusion type, user IDs, tags, or other criteria to audit or report on security exceptions.

Properties

Name	Meaning
Additional Query Parameters	A collection of optional filters and parameters to customize the exclusions query, such as limiting results, filtering by exclusion type, date ranges, user or group IDs, tags, sorting options, and more.

Output

JSON

items - Array of exclusion objects matching the query filters.
count - Total number of exclusions matching the query (if countOnly is true or skipCount is false).
cursor - Cursor string for pagination to fetch the next set of exclusions.

Dependencies

Requires an API key credential for AvantGuard SentinelOne API access.
Relies on the '@avantguardllc/n8n-openapi-node' package for OpenAPI integration.

Troubleshooting

If the API returns authentication errors, verify that the API key credential is correctly configured and has necessary permissions.
If no exclusions are returned, check the filter parameters for correctness and ensure the queried data exists.
Pagination issues can occur if the cursor parameter is not used properly; use the cursor returned from previous responses to iterate over large result sets.
Invalid date formats in timestamp filters may cause errors; ensure timestamps are in ISO 8601 format or as specified.
Exceeding the limit parameter beyond allowed range (1-1000) will cause errors; keep within valid limits.