Integrations
- Integrations
- 1Password
- Abnormal
- Absolute
- AbuseIPDB
- Acronis
- Active Directory On-Prem
- Adaptive Shield
- Adobe Cloud
- ADP
- Agari Phishing Response
- Airlock
- Airlock Digital
- Akamai Identity Cloud Social
- Alert Logic
- AlgoSec Firewall Analyzer
- Alienvault OTX
- Alienvault USM
- Anthropic
- Anodot
- Any Run
- Ansible
- Anvilogic
- Apex One
- ArcSight ESM
- Area 1
- Asana
- Asset Panda
- Astrix
- Atlassian Crowd
- Atlassian User Management
- Atlassian User Provisioning
- AuditBoard
- auth0
- Authentik
- Authomize
- Automox
- AWS
- AWS IAM Identity Center
- Axonius
- Azure
- Azure Data Explorer
- Azure DevOps
- Azure Log Analytics
- Azure Storage
- BambooHR
- Big Fix
- BigPanda
- Bitbucket
- Bitdefender
- Bitsight
- Bitwarden
- Black Duck
- Black Kite
- Blink
- BMC Remedy
- Box
- Brinqa
- Cato Networks
- Censys
- Chorus
- Cisco Advanced Phishing Protection
- Cisco Domain Protection
- Cisco Meraki
- Cisco Talos
- Cisco Umbrella
- Cisco Webex
- Claroty xDome
- ClearPass
- ClickHouse
- ClickUp
- Cloud Custodian
- Cloudflare
- Cloudflare R2
- Cobalt.io
- Check Point Harmony
- Check Point Infinity Events
- Check Point Management
- Check Point XDR/XPR
- Checkmarx SAST
- Checkmarx One
- Chronicle
- Compass
- Confluence
- Confluence Data Center
- Coralogix
- Coralogix Incident Management
- Cortex XDR
- Cortex Xpanse
- Coupa Compass
- CredStash
- Cribl
- CrowdStrike
- CyberArk
- Cybersixgill
- CyCognito
- Cyera
- Cylance
- Cyware CTIX
- Darktrace
- Dasera
- Databricks
- Datadog
- DataSet
- Discord
- Docusign
- Delighted
- Delinea
- Devo
- Domo
- Drata
- Dropbox
- Dropbox Business
- druva
- Duo
- Duo Auth
- Dynatrace
- EasyVista
- EchoTrail
- Egnyte
- Egnyte Secure Govern
- Elasticsearch
- Entro
- Entrust Certificate Services
- Ermetic
- Exabeam
- Exchange Online
- Expel
- F5
- Falcon LogScale
- Falcon Surface
- Fastly
- Flare.io
- Forcepoint DLP
- Forescout
- FortiGate
- Freshservice
- GCP
- Gemini
- Ghostwriter
- Git
- GitHub
- GitLab
- Glean
- Gmail
- Google Calendar
- Google Chat
- Google Docs
- Google Drive
- Google Forms
- Google Meet
- Google Looker
- Google Sheets
- Google Workspace
- Grafana
- Greenhouse
- GreyNoise
- Grip Security
- GYTPOL
- Have I Been Pwned
- HackerOne
- Halo Service Desk
- HackNotice
- HiBob
- HubSpot
- Hunters
- Hybrid Analysis
- Hyperproof
- IBM CLoud
- IBM NS1 Connect
- IBM X Force
- Imperva
- Incident.io
- Infobip
- Infoblox Cloud Services Portal
- Intercom
- Intezer
- IP API
- IPinfo
- IPWHOIS
- Ivanti RiskSense
- Ironscales
- Jamf
- JetBrains
- JFrog
- Jira
- Jira Data Center
- Joe Sandbox
- JumpCloud
- Kandji
- Keeper Secrets Manager
- Kenna Security
- KnowBe4
- KnowBe4 Events
- Kubernetes
- Lacework
- LaunchDarkly
- LimaCharlie
- Linear
- Litmos
- Living Security
- LogicMonitor
- LogRhythm
- Manage Engine ServiceDesk Plus
- Mattermost
- Maven
- Microsoft Defender For Cloud
- Microsoft Defender For Cloud Apps
- Microsoft Defender For Endpoints
- Microsoft Defender XDR
- Microsoft E-Discovery
- Microsoft Entra ID
- Microsoft Graph
- Microsoft Intune
- Microsoft Office 365 Management Activity
- Microsoft Outlook
- Microsoft Purview
- Microsoft Sentinel
- Microsoft SQL Server
- Microsoft Teams
- Mimecast
- MISP
- Monday
- MongoDB Atlas
- MxToolbox
- Neo4j
- NetBox
- Netography
- Netskope
- New Relic
- Nightfall AI
- NinjaOne
- Notion
- Nozomi Networks
- Nuclei
- Nucleus
- Nutanix Hypervisor
- Obsidian
- Okta
- OneDrive
- OneLogin
- OneTrust
- Oort
- OpenAI
- OpenCTI
- Opsgenie
- OPSWAT
- Oracle Cloud
- Oracle HCM
- Orca Security
- OWASP ZAP
- PagerDuty
- Palo Alto NGFW
- Palo Alto Firewall
- Panther
- Pentera
- Perception Point
- PhishLabs
- PhishLabs Incident Data
- PhishLabs Open Web Monitoring
- Pingdom
- PingID
- PingOne
- PlexTrac
- PortSwigger
- Power BI
- PowerShell
- Postman
- Postman SCIM
- Prisma Access
- Prisma Cloud
- Prisma Cloud CWP
- Prometheus
- Proofpoint
- Proofpoint ITM
- Proofpoint Protection Server
- Proofpoint Security Awareness Training
- Proofpoint TAP
- Proofpoint TRAP
- Pub-Sub
- QRadar
- Qualys
- Rapid7
- Rapid7 InsightIDR
- Rapid7 InsightVM Cloud
- Rapid7 Threat Command
- Reco
- Recorded Future
- Recorded Future Triage Cloud
- Red Hat IDM
- Rippling
- runZero
- SafeBase
- Sage HR
- SailPoint
- SailPoint IdentityIQ
- Salesforce
- SAP Ariba
- Sap Concur
- ScienceLogic
- Securin
- Securin VI
- SecurityScorecard
- Securonix
- Seemplicity
- Sekoia.io
- SemGrep
- SentinelOne
- SentinelOne
- Actions
- Overview
- Abort Scan
- Add Threat To Exclusions
- Add To Block List
- Add To Blocklist Deep Visibility
- Ban Hash
- Broadcast Message To Users
- Create Deep Visibility Query
- Create Firewall Rule
- Create USB Device Control Rule
- Deep Visibility Query
- Delete Firewall Rules
- Delete User
- Disable Agent
- Download From Cloud
- Enable Agent
- Export Agents Data
- Export Events
- Export Mitigation Report
- Export Threat Timeline
- Export Threats
- Fetch Deep Visibility Query Results
- Get Account By ID
- Get Agents Count
- Get Alerts
- Get CVEs For Application
- Get Endpoint Tags
- Get Events
- Get Local Upgrade Agent Authorization
- Get Passphrases
- Get Threat Timeline
- Get Threats
- Initiate Scan
- Isolate Endpoint
- Lift Endpoint Isolation
- List Accounts
- List Activities
- List Activities Types
- List Agent Applications
- List Agents
- Mitigate Threats
- SentinelOne Custom Action
- Uninstall Agent
- Update Alert Analyst Verdict
- Update Incident Details Of An Alert
- Update Threat Analyst Verdict
- Update Threat External Ticket ID
- Update Threat Incident
- ServiceNow
- SharePoint
- Shodan
- Shopify
- Silverfort
- Slack
- Smartsheet
- Snipe IT
- Snowflake
- Snyk
- SolarWinds Information Service
- SolarWinds Service Desk
- SonarQube
- Sophos
- Split
- Splunk
- Splunk Observability
- Splunk SOAR
- Spur
- StrongDM
- Sumo Logic
- Symantec EDR
- Sysdig
- Tableau
- Tanium
- TeamCity
- TeamViewer
- Telegram
- Tempo
- Tenable
- Tenable Security Center
- Terraform
- Terraform Cloud
- Tessian
- TheHive
- Thinkst Canary
- ThreatQuotient
- Trellix Email Security
- Trello
- Trend Vision One
- Twilio
- UKG HR
- Uptycs
- URLScan
- Vault
- Veracode
- Verkada
- Vertica
- VMware vSphere
- VMware Carbon Black
- VirusTotal
- WeChat
- WhatsApp
- WhoIs
- WildFire
- Wiz
- Workday
- Workspace ONE UEM
- YesWeHack
- Zendesk
- Zero Networks
- Zoom
- Zscaler Internet Access
- Zscaler Private Access
Actions
Export Agents Data
Get agent data in a CSV form, for agents that match the filter.
Basic Parameters
Parameter | Description |
---|---|
Active Threats | Include agents with this amount of active threats. Example: 3. |
Agents UUIDs | Agents UUIDs to retrieve their data. |
Is Active | Include only active agents. |
Advanced Parameters
Parameter | Description |
---|---|
Account IDs | List of account IDs to filter by. Example: 225494730938493804,225494730938493915. |
Active Directory Query | An Active Directory query string. Example: CN=Managers,DC=sentinelone,DC=com. |
Example Output
"Endpoint Name","Site","Last Logged In User","OS Username","Group","Tags","Domain","Account","Console Visible IP","Agent Version","Serial Number","Last Active","Subscribed On","Health Status","Device Type","Model Name","OS","OS Version","Architecture","Memory","CPU Count","CPU Type","Core Count","Management Connectivity","Network Status","Update Status","Scan Status","MAC Addresses","IP Addresses","Last Reported IP","Pending Uninstall","Disk Encryption","Agent UUID","Agent ID","Customer Identifier","Console Migration Status","Locations","Operational State","Operational State Expiration","Last Reboot Date","Installer Type","Reboot Required due to Threat","User Action Required","Remote Profiling State","Remote Profiling Expiration","Storage Type","Storage Name","Cloud Account","Cloud Location","Cloud Network","Cloud Image","Cloud Tags","Cloud Instance Size","Cloud Instance ID","Cloud Security Group","Cluster Name","K8s Type","K8s Version","Agent Namespace","Agent Pod Name","K8s Node Name","K8s Node Labels","ECS Type","ECS Version","ECS Cluster Name","ECS Task Arn","ECS Task Availability Zone","ECS Service Name","ECS Service Arn","ECS Task Definition Family","ECS Task Definition Revision","ECS Task Definition Arn","Is Uninstalled","Decommissioned at","Missing Permissions"
"DESKTOP-CORP-HR2345","Corporate HQ - Prod","john.smith","administrator","Finance Team","Production,High-Priority","CORP.EXAMPLE.COM","78342 - EXAMPLE Corp","192.168.1.145","25.2.4.8891","X9Y7Z6W5V4","May 04, 2025 10:15:32 AM","Mar 15, 2025 09:22:11 AM","Healthy","desktop","OptiPlex 7090","Windows","Windows 11 Enterprise, 23H2","x64","32 GB",8,"Intel Core i7-11700",16,"Online","Connected","Up to date","Completed( May 04, 2025 09:45:21 AM )","['a4:b5:c6:d7:e8', '12:34:56:78:90', 'bc:de:f0:12:34:56']","['192.168.1.145', 'fe80::abc:def:123:456', '10.10.10.25', '172.16.0.45']","192.168.1.145","No","Off","A1B2C3D4-E5F6-7890-ABCD-EF1234567890",9876543210123456789,"EXAMPLE-CORP-001","Completed","['HQ-Network']","Not disabled","N/A","May 04, 2025 08:30:15 AM","MSI","No","[]","enabled","May 10, 2025 10:15:32 AM","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","N/A","No","N/A","[]"
Workflow Library Example
Export Agents Data with Sentinelone and Send Results Via Email
Preview this Workflow on desktop
Was this page helpful?
Assistant
Responses are generated using AI and may contain mistakes.