AvantGuard - SentinelOne

Actions682

Overview

This node operation retrieves data from the 'Unprotected Endpoints Discovery' resource, specifically fetching a paginated and filterable list of devices or endpoints identified as 'Web API Rogues'. It allows users to query and filter devices based on numerous criteria such as OS type, version, manufacturer, IP addresses, MAC addresses, timestamps for first and last seen, device types, and more. This is useful for security analysts or network administrators who want to discover and analyze potentially vulnerable or unprotected endpoints in their network environment. For example, a user can fetch all devices first seen after a certain date, filter by OS version containing 'Service Pack 1', or limit results to a specific manufacturer, helping to identify and assess security risks.

Properties

Name	Meaning
Additional Query Parameters	Optional filters and pagination controls to refine the search query for unprotected endpoints, including count only flag, limit, skip, cursor for pagination, sorting options, and various device attributes such as OS type, version, manufacturer, IP addresses, MAC addresses, timestamps, and group or site IDs.

Output

JSON

data - Array of device objects matching the query filters, each representing an unprotected endpoint with its attributes.
totalCount - Total number of matching devices if countOnly is true or skipCount is false.
cursor - Cursor string for pagination to fetch the next set of results.

Dependencies

Requires API authentication credentials to connect to the AvantGuard SentinelOne API endpoint specified in the node credentials.

Troubleshooting

Ensure that the API credentials are correctly configured and have sufficient permissions to access the 'Unprotected Endpoints Discovery' resource.
If the node returns empty results, verify that the query parameters are correctly set and that the filters match existing data.
Pagination parameters like 'cursor' and 'skip' must be used correctly to iterate over large result sets; incorrect usage may result in missing data.
Invalid date formats in timestamp filters (e.g., 'firstSeen__gt') can cause errors; use ISO 8601 format as shown in examples.
If the API returns errors related to query parameters, check that JSON arrays are properly formatted and that string parameters do not contain invalid characters.