n8n-nodes-sentinelone

An n8n community node for interacting with the SentinelOne API v2.1. Manage your endpoint security infrastructure directly from your n8n workflows.

Features

Activity Operations (Audit Log)

| Operation | Description | |-----------|-------------| | Get Activities | Retrieve activity/audit log entries with filtering | | Get Activity Types | Get list of activity types for filtering |

Agent Operations

| Operation | Description | |-----------|-------------| | Abort Scan | Abort a running scan on agents | | Connect to Network | Reconnect isolated agents to the network | | Decommission | Decommission agents (remove from console) | | Disable Agent | Disable protection on agents | | Disconnect from Network | Quarantine/isolate agents from the network | | Enable Agent | Enable protection on agents | | Fetch Logs | Request agents to upload diagnostic logs | | Get Agents | Retrieve agents with comprehensive filtering options | | Get Applications | Get installed applications for specific agents | | Get Passphrase | Get the passphrase for specific agents | | Initiate Scan | Run full disk scans on targeted agents | | Move to Site | Move agents to a different site | | Restart Machine | Remotely restart endpoints | | Shutdown | Remotely shut down endpoints | | Uninstall Agent | Remove SentinelOne agents from endpoints | | Update Software | Initiate agent software update |

Device Control Operations

| Operation | Description | |-----------|-------------| | Create Rule | Create device control rules scoped to sites, groups, accounts, or global | | Delete Rules | Delete device control rules by ID | | Get Device Events | Retrieve device control events (blocked/allowed devices) | | Get Device Rules | Retrieve device control rules with filtering by interface, device class, action, etc. | | Update Rule | Update existing device control rules |

Exclusion Operations

| Operation | Description | |-----------|-------------| | Create Exclusion | Create whitelist/exclusion entries (path, hash, certificate, etc.) | | Delete Exclusions | Delete exclusion entries by ID | | Get Exclusions | Retrieve exclusions with filtering | | Update Exclusion | Update existing exclusion entries |

Group Operations

| Operation | Description | |-----------|-------------| | Get Groups | Retrieve groups with filtering | | Move Agents | Move agents to a specific group |

Hash Operations

| Operation | Description | |-----------|-------------| | Get Verdict | Get the reputation/verdict for a SHA1 hash |

Site Operations

| Operation | Description | |-----------|-------------| | Get Sites | Retrieve sites with filtering |

Tag Operations

| Operation | Description | |-----------|-------------| | Get Tags | Retrieve endpoint tags | | Manage Tags | Add, remove, or override tags on agents |

Threat Operations

| Operation | Description | |-----------|-------------| | Get Threats | Retrieve threats with filtering by status, verdict, OS type, etc. | | Mitigate Threat | Apply mitigation actions (kill, quarantine, remediate, rollback, un-quarantine, network-quarantine) |

Installation

Community Nodes (Recommended)

1. Go to Settings > Community Nodes
2. Select Install
3. Enter n8n-nodes-sentinelone
4. Agree to the risks and click Install

Manual Installation

# In your n8n installation directory
npm install n8n-nodes-sentinelone

Credentials

You'll need to configure your SentinelOne API credentials:

| Field | Description | |-------|-------------| | API URL | Your SentinelOne console URL (e.g., https://usea1-partners.sentinelone.net) | | API Token | Your API token from SentinelOne console |

Getting Your API Token

1. Log in to your SentinelOne Management Console
2. Navigate to Settings > Users
3. Select your user or create a service user
4. Click Generate API Token
5. Copy the token (it won't be shown again!)

Operations Detail

Agent: Get Agents

Retrieve a list of agents with powerful filtering capabilities.

Filters Available:

• Account/Site/Group IDs
• Computer name (contains)
• External IP (contains)
• OS Types (Windows, macOS, Linux)
• Machine Types (Desktop, Laptop, Server, Kubernetes, etc.)
• Network Status (Connected, Disconnected)
• Scan Status
• Infection status
• Agent version
• And many more...

Agent: Get Applications

Retrieve installed applications for specific agents.

Required: Agent IDs (comma-separated)

Agent: Actions (Scan, Connect, Disconnect, Restart, Shutdown, Uninstall)

Target agents by:

• Agent IDs: Specific agent IDs (comma-separated)
• Filter: Dynamic filter criteria (OS type, site, group, infection status, etc.)

Threat: Get Threats

Retrieve threats with filtering:

• Analyst Verdicts (True Positive, False Positive, Suspicious, Undefined)
• Incident Statuses (In Progress, Resolved, Unresolved)
• Mitigation Statuses (Mitigated, Active, Blocked, Pending, etc.)
• Content Hash, Classification
• Date ranges

Threat: Mitigate Threat

Apply mitigation actions:

• Kill - Terminate the threat process
• Quarantine - Quarantine the threat file
• Remediate - Remediate the threat (macOS/Windows)
• Rollback Remediation - Rollback remediation (Windows only)
• Un-Quarantine - Release from quarantine
• Network Quarantine - Network isolate the affected endpoint

Device Control: Create Rule

Create a new device control rule with:

• Scope: Global (Tenant), Account, Site, or Group level
• Interface: USB, Bluetooth, Thunderbolt, eSATA
• Rule Type: Device Class, Vendor ID, Product ID, Device ID, Bluetooth Version
• Action: Allow, Block, Read-Only
• Status: Enabled or Disabled

Device Control: Get Device Rules

Retrieve device control rules with filtering:

• Interfaces (USB, Bluetooth, Thunderbolt, eSATA)
• Device Classes (Mass Storage, Printer, Portable Device, Communication)
• Actions (Allow, Block, Read-Only)
• Scopes (Account, Global, Group, Site)
• Statuses (Enabled, Disabled)

Device Control: Update Rule

Update an existing device control rule by ID. Modifiable fields:

• Rule Name, Action, Status, Device Class, Vendor ID, Product ID

Device Control: Delete Rules

Delete device control rules by providing rule IDs (comma-separated).

Device Control: Get Device Events

Retrieve device control events with filtering:

• Event Types (Blocked, Allowed, Read-Only)
• Interfaces, Agent IDs, Site/Group IDs
• Date ranges, Computer name, Query search

Tag: Get Tags & Manage Tags

• Get Tags: Retrieve endpoint tags with filtering
• Manage Tags: Add, remove, or override tags
  • Supports key-value pairs
  • Target by Agent IDs or filter criteria

Example Workflows

Automated Threat Response

Trigger: Webhook from SIEM
    |
SentinelOne: Get Threats (filter: unresolved)
    |
IF: severity == high
    |
SentinelOne: Mitigate Threat (action: quarantine)
    |
SentinelOne: Disconnect from Network
    |
Slack: Notify Security Team

Daily Security Report

Trigger: Schedule (Daily 8 AM)
    |
SentinelOne: Get Agents (filter: isActive=true)
    |
SentinelOne: Get Threats (filter: last 24 hours)
    |
Function: Calculate statistics
    |
Email: Send daily report

Endpoint Tagging Automation

Trigger: Webhook (new employee)
    |
SentinelOne: Get Agents (filter: computerName contains "new-laptop")
    |
SentinelOne: Manage Tags (action: add, key: department, value: engineering)

Device Control Audit

Trigger: Schedule (Weekly)
    |
SentinelOne: Get Device Rules (filter: interface=USB, action=Allow)
    |
Function: Format audit report
    |
Google Sheets: Append to compliance log

Block USB Storage on New Sites

Trigger: Webhook (new site created)
    |
SentinelOne: Create Rule (scope: site, interface: USB, deviceClass: Mass Storage, action: Block)
    |
SentinelOne: Get Device Events (filter: siteId, eventType: blocked)
    |
Slack: Notify IT team of new policy

API Reference

This node uses the SentinelOne API v2.1. For complete API documentation, visit your SentinelOne console's API documentation at:

https://your-console.sentinelone.net/api-doc/overview

Compatibility

• n8n Version: 0.5.0+
• Node.js: 18+
• SentinelOne API: v2.1

Support

• Issues: GitHub Issues
• SentinelOne Docs: Developer Portal

Changelog

v0.4.0

• Added new resources:
  • Activity: Get audit log entries and activity types
  • Exclusion: Full CRUD for whitelist/exclusion management
  • Group: Get groups and move agents between groups
  • Hash: Get reputation verdict for SHA1 hashes
  • Site: Get sites with filtering
• Expanded Agent operations:
  • Abort Scan, Decommission, Disable Agent, Enable Agent
  • Fetch Logs, Get Passphrase, Move to Site, Update Software
• Now supports 9 resources with 30+ operations

v0.3.0

• Expanded Device Control operations:
  • Create Rule (with site/group/account/global scoping)
  • Update Rule
  • Delete Rules
  • Get Device Events
• Enhanced rule creation with support for device class, vendor ID, product ID, and Bluetooth version matching

v0.2.0

• Added Threat operations (Get Threats, Mitigate Threat)
• Added Device Control operations (Get Device Rules)
• Added Tag operations (Get Tags, Manage Tags)
• Enhanced filtering options for all operations

v0.1.0

• Initial release
• Agent operations (Get Agents, Get Applications, Actions)

License

MIT

Made with :purple_heart: for the n8n community