AvantGuard - SentinelOne

Actions682

Overview

This node operation 'Web Api Remote Ops Schedule Forensics Post' under the 'Remote Ops MMS' resource allows users to schedule forensic data collection tasks remotely. It accepts filtering criteria to specify target sites, groups, IDs, or accounts, and detailed scheduling and action data to define when and how the forensic collection should occur. This is useful for automating forensic investigations in managed environments, such as scheduling data collection at specific times or recurring intervals for security audits or incident response.

Properties

Name	Meaning
Filter	Specifies the filtering criteria to select the target entities for the forensic scheduling. It includes arrays of site IDs, group IDs, entity IDs, and account IDs to precisely scope the operation.
Data	Contains the scheduling details and action parameters. Scheduling includes the scheduled time, expiration time, and recurrence unit (e.g., day). Action defines the destination profile and collection profile IDs, including password scope information for authentication.

Output

JSON

response - The JSON response from the remote API after scheduling the forensic operation, typically including status, identifiers, or confirmation details.

Dependencies

Requires an API key credential for authentication to the AvantGuard SentinelOne API or equivalent remote operations API.
Depends on the '@avantguardllc/n8n-openapi-node' package for OpenAPI integration.

Troubleshooting

Invalid or missing API credentials will cause authentication failures; ensure the API key is correctly configured.
Malformed JSON in the 'Filter' or 'Data' properties can cause request errors; validate JSON syntax before execution.
Incorrect or unsupported scheduling times or recurrence units may result in API errors; verify the scheduling parameters conform to API specifications.
Network connectivity issues to the remote API endpoint can cause timeouts or failures; check network access and base URL configuration.