Disable agents that match the filter. If the command returns “Insufficient permissions”, make sure you have permissions for the Account, Site, or Group and a role that allows Disable Agent (Admin, IR team or IT).

Parameters

ParameterDescription
Expirationagents will be re-enabled after this timestamp.
Expiration TimezoneTimezone for the expiration timestamp.
Should RebootIf true, reboot the endpoint.
agents UUIDsList of agents’ universally unique identifiers.

Example Output

{
	"data": {
		"affected": 0
	}
}

Workflow Library Example

Disable Agent with Sentinelone and Send Results Via Email

Preview this Workflow on desktop