SentinelOne - Remove Asset

Article summary

Did you find this summary helpful?

Thank you for your feedback

SentinelOne - Remove Asset removes an asset from SentinelOne for:

Assets that match the results of the selected saved query, and match the Enforcement Action Conditions, if defined or assets selected on the relevant asset page.

Note:

To use this option, you must successfully configure a SentinelOne adapter connection.

See Creating Enforcement Sets to learn more about adding Enforcement Actions to Enforcement Sets.

Note:

Not all asset categories are supported for all Enforcement Actions.
- See Actions supported for Activity Logs, Adapters Fetch History, and Asset Investigation modules.
- See Actions supported for Vulnerabilities.
- See Actions supported for Software.

General Settings

Action name - The name of this Enforcement Action. The system sets a default name. You can change the name.
Configure Dynamic Values - Toggle on to enter a Dynamic Value statement. See Creating Enforcement Action Dynamic Value Statements to learn more about Dynamic Value statement syntax.

Use stored credentials from the SentinelOne Adapter - Select this option to use the first connected SentinelOne adapter credentials. See SentinelOne Adapter.
- When you select this option, the Select Adapter Connection drop-down is available, and you can choose which adapter connection to use for this Enforcement Action.

These fields must be configured to run the Enforcement Set.

Compute Node - The Axonius node to use when connecting to the specified host. For more details, see Connecting Additional Axonius Nodes.

These fields are optional.

Gateway Name - Select the Gateway through which to connect to perform the action.

Axonius uses the SentinelOne API.

The credentials of the connection selected in General Setting must have read/write access to SentinelOne.

For more details about other Enforcement Actions available, see Action Library.

Was this article helpful?

Table of contents