Get agent data in a CSV form, for agents that match the filter.

​
Basic Parameters

ParameterDescription
Active ThreatsInclude agents with this amount of active threats. Example: 3.
Agents UUIDsAgents UUIDs to retrieve their data.
Is ActiveInclude only active agents.

​
Advanced Parameters

ParameterDescription
Account IDsList of account IDs to filter by. Example: 225494730938493804,225494730938493915.
Active Directory QueryAn Active Directory query string. Example: CN=Managers,DC=sentinelone,DC=com.

​
Example Output

"Endpoint Name","Site","Last Logged In User","OS Username","Group","Tags","Domain","Account","Console Visible IP","Agent Version","Serial Number","Last Active","Subscribed On","Health Status","Device Type","Model Name","OS","OS Version","Architecture","Memory","CPU Count","CPU Type","Core Count","Management Connectivity","Network Status","Update Status","Scan Status","MAC Addresses","IP Addresses","Last Reported IP","Pending Uninstall","Disk Encryption","Agent UUID","Agent ID","Customer Identifier","Console Migration Status","Locations","Operational State","Operational State Expiration","Last Reboot Date","Installer Type","Reboot Required due to Threat","User Action Required","Remote Profiling State","Remote Profiling Expiration","Storage Type","Storage Name","Cloud Account","Cloud Location","Cloud Network","Cloud Image","Cloud Tags","Cloud Instance Size","Cloud Instance ID","Cloud Security Group","Cluster Name","K8s Type","K8s Version","Agent Namespace","Agent Pod Name","K8s Node Name","K8s Node Labels","ECS Type","ECS Version","ECS Cluster Name","ECS Task Arn","ECS Task Availability Zone","ECS Service Name","ECS Service Arn","ECS Task Definition Family","ECS Task Definition Revision","ECS Task Definition Arn","Is Uninstalled","Decommissioned at","Missing Permissions"

"DESKTOP-CORP-HR2345","Corporate HQ - Prod","john.smith","administrator","Finance Team","Production,High-Priority","CORP.EXAMPLE.COM","78342 - EXAMPLE Corp","192.168.1.145","25.2.4.8891","X9Y7Z6W5V4","May 04, 2025 10:15:32 AM","Mar 15, 2025 09:22:11 AM","Healthy","desktop","OptiPlex 7090","Windows","Windows 11 Enterprise, 23H2","x64","32 GB",8,"Intel Core i7-11700",16,"Online","Connected","Up to date","Completed( May 04, 2025 09:45:21 AM )","['a4:b5:c6:d7:e8', '12:34:56:78:90', 'bc:de:f0:12:34:56']","['192.168.1.145', 'fe80::abc:def:123:456', '10.10.10.25', '172.16.0.45']","192.168.1.145","No","Off","A1B2C3D4-E5F6-7890-ABCD-EF1234567890",9876543210123456789,"EXAMPLE-CORP-001","Completed","['HQ-Network']","Not disabled","N/A","May 04, 2025 08:30:15 AM","MSI","No","[]","enabled","May 10, 2025 10:15:32 AM","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","No","N/A","[]"

​
Workflow Library Example

Export Agents Data with Sentinelone and Send Results Via Email

Preview this Workflow on desktop

Get agent data in a CSV form, for agents that match the filter.

​
Basic Parameters

ParameterDescription
Active ThreatsInclude agents with this amount of active threats. Example: 3.
Agents UUIDsAgents UUIDs to retrieve their data.
Is ActiveInclude only active agents.

​
Advanced Parameters

ParameterDescription
Account IDsList of account IDs to filter by. Example: 225494730938493804,225494730938493915.
Active Directory QueryAn Active Directory query string. Example: CN=Managers,DC=sentinelone,DC=com.

​
Example Output

"Endpoint Name","Site","Last Logged In User","OS Username","Group","Tags","Domain","Account","Console Visible IP","Agent Version","Serial Number","Last Active","Subscribed On","Health Status","Device Type","Model Name","OS","OS Version","Architecture","Memory","CPU Count","CPU Type","Core Count","Management Connectivity","Network Status","Update Status","Scan Status","MAC Addresses","IP Addresses","Last Reported IP","Pending Uninstall","Disk Encryption","Agent UUID","Agent ID","Customer Identifier","Console Migration Status","Locations","Operational State","Operational State Expiration","Last Reboot Date","Installer Type","Reboot Required due to Threat","User Action Required","Remote Profiling State","Remote Profiling Expiration","Storage Type","Storage Name","Cloud Account","Cloud Location","Cloud Network","Cloud Image","Cloud Tags","Cloud Instance Size","Cloud Instance ID","Cloud Security Group","Cluster Name","K8s Type","K8s Version","Agent Namespace","Agent Pod Name","K8s Node Name","K8s Node Labels","ECS Type","ECS Version","ECS Cluster Name","ECS Task Arn","ECS Task Availability Zone","ECS Service Name","ECS Service Arn","ECS Task Definition Family","ECS Task Definition Revision","ECS Task Definition Arn","Is Uninstalled","Decommissioned at","Missing Permissions"

"DESKTOP-CORP-HR2345","Corporate HQ - Prod","john.smith","administrator","Finance Team","Production,High-Priority","CORP.EXAMPLE.COM","78342 - EXAMPLE Corp","192.168.1.145","25.2.4.8891","X9Y7Z6W5V4","May 04, 2025 10:15:32 AM","Mar 15, 2025 09:22:11 AM","Healthy","desktop","OptiPlex 7090","Windows","Windows 11 Enterprise, 23H2","x64","32 GB",8,"Intel Core i7-11700",16,"Online","Connected","Up to date","Completed( May 04, 2025 09:45:21 AM )","['a4:b5:c6:d7:e8', '12:34:56:78:90', 'bc:de:f0:12:34:56']","['192.168.1.145', 'fe80::abc:def:123:456', '10.10.10.25', '172.16.0.45']","192.168.1.145","No","Off","A1B2C3D4-E5F6-7890-ABCD-EF1234567890",9876543210123456789,"EXAMPLE-CORP-001","Completed","['HQ-Network']","Not disabled","N/A","May 04, 2025 08:30:15 AM","MSI","No","[]","enabled","May 10, 2025 10:15:32 AM","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","No","N/A","[]"

​
Workflow Library Example

Export Agents Data with Sentinelone and Send Results Via Email

Preview this Workflow on desktop