The "QuickAction - Connect or Disconnect a SentinelOne Agent" workflow template streamlines network management for SOC teams by enabling rapid connection or disconnection of SentinelOne agents through a single QuickAction command. This efficient process enhances incident response capabilities, allowing analysts to swiftly manage agent statuses based on real-time threat assessments, ensuring optimal network security and operational continuity.
Use Cases
Case Management
Workflow Breakdown
Trigger workflow via QuickAction.
Receive agent ID and desired action (connect/disconnect).
Query current agent status in SentinelOne, and submits a disconnection or connection request.
Monitor for success or failure response.
Vendors
Utils, SentinelOne, Torq Cases
Workflow Output
Returns the agent hostname, action taken (connect/disconnect), and operation status (success/failure).
Tips
Use the "Poll for new SentinelOne Threats and Open a Torq Case" template to ensure correct custom field creation.