SentinelOne - Enable Or Disable Agent

SentinelOne - Enable Or Disable Agent enables or disables SentinelOne agents for:

• Assets returned by the selected query or assets selected on the relevant asset page.

Required Fields

These fields must be configured to run the Enforcement Action.

• Use stored credentials from the SentinelOne adapter - Select this option to use credentials from the adapter connection. By default, the first connection is selected.

  • When you select this option, the Select Adapter Connection drop-down becomes available. Select the adapter connection to use for this Enforcement Action.

  📘

  Note

  To use this option, you must successfully configure a SentinelOne adapter connection.

• Compute Node - The Axonius node to use when connecting to the specified host. For more details, see Working with Axonius Compute Nodes.

Additional Fields

These fields are optional.

💡

Connection and Credentials

When Use stored credentials from the adapter is toggled off, some of the connection fields below are required to create the connection, while other fields are optional.

• SentinelOne Domain - The domain of the SentinelOne service.
• User Name, Password, 2FA Secret, and API token - These parameters are required only for customers with the Axonius SaaS Applications product. For more information on these parameters, see Required Parameters - Application Settings.
• Singularity Data Lake (SDL) API Key (optional) - You can leave this parameters empty as it's not relevant for this action.

• Verify SSL (optional) - Select whether to verify the SSL certificate of the server against the CA database inside of Axonius. For more details, see SSL Trust & CA Settings.

• HTTPS Proxy (optional) - Connect the adapter to a proxy instead of directly connecting it to the domain.

• Gateway Name - Select the Gateway through which to connect to perform the action.

• Disable agents instead of enabling - This action enables agents by default. Check this option to disable agents instead.
• Reboot the endpoint - Select whether this action should reboot the endpoint (parameter required by the SentinelOne API).

APIs

Axonius uses the following APIs:

Enable Agent | SentinelOne Disable Agent | SentinelOne

Required Permissions

• Permissions for the account, site, or group where the agent needs to be enabled/disabled
• A role that allows to disable agents: Admin, IR team or IT

Version Matrix

This Enforcement Action was tested only with the versions marked as supported, but may work with other versions. Please contact Axonius Support if you have a version that is not listed and it is not functioning as expected.