Disable Agent

Disable agents that match the filter. If the command returns "Insufficient permissions", make sure you have permissions for the Account, Site, or Group and a role that allows Disable Agent (Admin, IR team or IT).

Parameters

Parameter	Description
Expiration	agents will be re-enabled after this timestamp.
Expiration Timezone	Timezone for the expiration timestamp.
Should Reboot	If true, reboot the endpoint.
agents UUIDs	List of agents' universally unique identifiers.

Example Output

{
    "errors": [
        {
            "type": "object"
        }
    ],
    "data": {
        "affected": "integer"
    }
}

Workflow Library Example

Disable Agent with Sentinelone and Send Results Via Email

Preview this Workflow on desktop