AvantGuard - SentinelOne

Actions682

Overview

This node operation retrieves forensic connection data for a specific application identified by its Application Id. It is useful for security analysts or IT professionals who need to investigate or monitor forensic connections related to a particular application within their environment. For example, it can be used to fetch connection details filtered by site, group, account, or country code to narrow down forensic data for targeted analysis.

Properties

Name	Meaning
Application Id	The unique identifier of the application for which forensic connection data is requested. This is a required string input.
Additional Query Parameters	Optional filters to refine the forensic connections data returned. Includes Site Ids, Group Ids, Account Ids, and Country Code to filter the results accordingly.

Output

JSON

forensicConnections - An array or object containing forensic connection details related to the specified application, filtered by any provided query parameters.

Dependencies

Requires an API key credential for authentication to the AvantGuard SentinelOne API service.
Depends on the '@avantguardllc/n8n-openapi-node' package for OpenAPI integration.

Troubleshooting

If the Application Id is missing or invalid, the node will fail to retrieve data. Ensure the Application Id is correctly provided.
Incorrect or malformed additional query parameters (e.g., invalid JSON arrays) may cause the API request to fail or return no results.
Network or authentication errors may occur if the API key credential is missing, expired, or incorrect. Verify API credentials and network connectivity.
If the API base URL is misconfigured in credentials, requests will fail. Confirm the base URL is correct.