Disable agents that match the filter. If the command returns “Insufficient permissions”, make sure you have permissions for the Account, Site, or Group and a role that allows Disable Agent (Admin, IR team or IT).

​
Parameters

ParameterDescription
Expirationagents will be re-enabled after this timestamp.
Expiration TimezoneTimezone for the expiration timestamp.
Should RebootIf true, reboot the endpoint.
agents UUIDsList of agents’ universally unique identifiers.

​
Example Output

{
	"errors": [
		{
			"type": "object"
		}
	],
	"data": {
		"affected": "integer"
	}
}

​
Workflow Library Example

Disable Agent with Sentinelone and Send Results Via Email

Preview this Workflow on desktop