n8n-nodes-sentinelone

An n8n community node for interacting with the SentinelOne API v2.1. Manage your endpoint security infrastructure directly from your n8n workflows.

Features

Activity Operations (Audit Log)

Operation	Description
Get Activities	Retrieve activity/audit log entries with filtering
Get Activity Types	Get list of activity types for filtering

Agent Operations

Operation	Description
Abort Scan	Abort a running scan on agents
Connect to Network	Reconnect isolated agents to the network
Decommission	Decommission agents (remove from console)
Disable Agent	Disable protection on agents
Disconnect from Network	Quarantine/isolate agents from the network
Enable Agent	Enable protection on agents
Fetch Logs	Request agents to upload diagnostic logs
Get Agents	Retrieve agents with comprehensive filtering options
Get Applications	Get installed applications for specific agents
Get Passphrase	Get the passphrase for specific agents
Initiate Scan	Run full disk scans on targeted agents
Move to Site	Move agents to a different site
Restart Machine	Remotely restart endpoints
Shutdown	Remotely shut down endpoints
Uninstall Agent	Remove SentinelOne agents from endpoints
Update Software	Initiate agent software update

Device Control Operations

Operation	Description
Create Rule	Create device control rules scoped to sites, groups, accounts, or global
Delete Rules	Delete device control rules by ID
Get Device Events	Retrieve device control events (blocked/allowed devices)
Get Device Rules	Retrieve device control rules with filtering by interface, device class, action, etc.
Update Rule	Update existing device control rules

Exclusion Operations

Operation	Description
Create Exclusion	Create whitelist/exclusion entries (path, hash, certificate, etc.)
Delete Exclusions	Delete exclusion entries by ID
Get Exclusions	Retrieve exclusions with filtering
Update Exclusion	Update existing exclusion entries

Group Operations

Operation	Description
Get Groups	Retrieve groups with filtering
Move Agents	Move agents to a specific group

Hash Operations

Operation	Description
Get Verdict	Get the reputation/verdict for a SHA1 hash

Site Operations

Operation	Description
Get Sites	Retrieve sites with filtering

Tag Operations

Operation	Description
Get Tags	Retrieve endpoint tags
Manage Tags	Add, remove, or override tags on agents

Threat Operations

Operation	Description
Get Threats	Retrieve threats with filtering by status, verdict, OS type, etc.
Mitigate Threat	Apply mitigation actions (kill, quarantine, remediate, rollback, un-quarantine, network-quarantine)

Installation

Community Nodes (Recommended)

1. Go to Settings > Community Nodes
2. Select Install
3. Enter n8n-nodes-sentinelone
4. Agree to the risks and click Install

Manual Installation

# In your n8n installation directory
npm install n8n-nodes-sentinelone

Credentials

You'll need to configure your SentinelOne API credentials:

Field	Description
API URL	Your SentinelOne console URL (e.g., https://usea1-partners.sentinelone.net)
API Token	Your API token from SentinelOne console

Getting Your API Token

1. Log in to your SentinelOne Management Console
2. Navigate to Settings > Users
3. Select your user or create a service user
4. Click Generate API Token
5. Copy the token (it won't be shown again!)

Operations Detail

Agent: Get Agents

Retrieve a list of agents with powerful filtering capabilities.

Filters Available:

• Account/Site/Group IDs
• Computer name (contains)
• External IP (contains)
• OS Types (Windows, macOS, Linux)
• Machine Types (Desktop, Laptop, Server, Kubernetes, etc.)
• Network Status (Connected, Disconnected)
• Scan Status
• Infection status
• Agent version
• And many more...

Agent: Get Applications

Retrieve installed applications for specific agents.

Required: Agent IDs (comma-separated)

Agent: Actions (Scan, Connect, Disconnect, Restart, Shutdown, Uninstall)

Target agents by:

• Agent IDs: Specific agent IDs (comma-separated)
• Filter: Dynamic filter criteria (OS type, site, group, infection status, etc.)

Threat: Get Threats

Retrieve threats with filtering:

• Analyst Verdicts (True Positive, False Positive, Suspicious, Undefined)
• Incident Statuses (In Progress, Resolved, Unresolved)
• Mitigation Statuses (Mitigated, Active, Blocked, Pending, etc.)
• Content Hash, Classification
• Date ranges

Threat: Mitigate Threat

Apply mitigation actions:

• Kill - Terminate the threat process
• Quarantine - Quarantine the threat file
• Remediate - Remediate the threat (macOS/Windows)
• Rollback Remediation - Rollback remediation (Windows only)
• Un-Quarantine - Release from quarantine
• Network Quarantine - Network isolate the affected endpoint

Device Control: Create Rule

Create a new device control rule with:

• Scope: Global (Tenant), Account, Site, or Group level
• Interface: USB, Bluetooth, Thunderbolt, eSATA
• Rule Type: Device Class, Vendor ID, Product ID, Device ID, Bluetooth Version
• Action: Allow, Block, Read-Only
• Status: Enabled or Disabled

Device Control: Get Device Rules

Retrieve device control rules with filtering:

• Interfaces (USB, Bluetooth, Thunderbolt, eSATA)
• Device Classes (Mass Storage, Printer, Portable Device, Communication)
• Actions (Allow, Block, Read-Only)
• Scopes (Account, Global, Group, Site)
• Statuses (Enabled, Disabled)

Device Control: Update Rule

Update an existing device control rule by ID. Modifiable fields:

• Rule Name, Action, Status, Device Class, Vendor ID, Product ID

Device Control: Delete Rules

Delete device control rules by providing rule IDs (comma-separated).

Device Control: Get Device Events

Retrieve device control events with filtering:

• Event Types (Blocked, Allowed, Read-Only)
• Interfaces, Agent IDs, Site/Group IDs
• Date ranges, Computer name, Query search

Tag: Get Tags & Manage Tags

• Get Tags: Retrieve endpoint tags with filtering
• Manage Tags: Add, remove, or override tags
  • Supports key-value pairs
  • Target by Agent IDs or filter criteria

Example Workflows

Automated Threat Response

Trigger: Webhook from SIEM
    |
SentinelOne: Get Threats (filter: unresolved)
    |
IF: severity == high
    |
SentinelOne: Mitigate Threat (action: quarantine)
    |
SentinelOne: Disconnect from Network
    |
Slack: Notify Security Team

Daily Security Report

Trigger: Schedule (Daily 8 AM)
    |
SentinelOne: Get Agents (filter: isActive=true)
    |
SentinelOne: Get Threats (filter: last 24 hours)
    |
Function: Calculate statistics
    |
Email: Send daily report

Endpoint Tagging Automation

Trigger: Webhook (new employee)
    |
SentinelOne: Get Agents (filter: computerName contains "new-laptop")
    |
SentinelOne: Manage Tags (action: add, key: department, value: engineering)

Device Control Audit

Trigger: Schedule (Weekly)
    |
SentinelOne: Get Device Rules (filter: interface=USB, action=Allow)
    |
Function: Format audit report
    |
Google Sheets: Append to compliance log

Block USB Storage on New Sites

Trigger: Webhook (new site created)
    |
SentinelOne: Create Rule (scope: site, interface: USB, deviceClass: Mass Storage, action: Block)
    |
SentinelOne: Get Device Events (filter: siteId, eventType: blocked)
    |
Slack: Notify IT team of new policy

API Reference

This node uses the SentinelOne API v2.1. For complete API documentation, visit your SentinelOne console's API documentation at:

https://your-console.sentinelone.net/api-doc/overview

Compatibility

• n8n Version: 0.5.0+
• Node.js: 18+
• SentinelOne API: v2.1

Support

• Issues: GitHub Issues
• SentinelOne Docs: Developer Portal

Changelog

v0.4.0

• Added new resources:
  • Activity: Get audit log entries and activity types
  • Exclusion: Full CRUD for whitelist/exclusion management
  • Group: Get groups and move agents between groups
  • Hash: Get reputation verdict for SHA1 hashes
  • Site: Get sites with filtering
• Expanded Agent operations:
  • Abort Scan, Decommission, Disable Agent, Enable Agent
  • Fetch Logs, Get Passphrase, Move to Site, Update Software
• Now supports 9 resources with 30+ operations

v0.3.0

• Expanded Device Control operations:
  • Create Rule (with site/group/account/global scoping)
  • Update Rule
  • Delete Rules
  • Get Device Events
• Enhanced rule creation with support for device class, vendor ID, product ID, and Bluetooth version matching

v0.2.0

• Added Threat operations (Get Threats, Mitigate Threat)
• Added Device Control operations (Get Device Rules)
• Added Tag operations (Get Tags, Manage Tags)
• Enhanced filtering options for all operations

v0.1.0

• Initial release
• Agent operations (Get Agents, Get Applications, Actions)

License

MIT

---

Made with :purple_heart: for the n8n community