search_inventory_items
Search managed assets in SentinelOne using flexible REST API filters. Find computers, servers, cloud resources, and network devices by name, type, status, tags, and more.
Instructions
Search for managed assets in SentinelOne using REST API filters.
Use this tool to find specific SentinelOne managed assets such as computers, servers, workstations, cloud resources, and network devices by various criteria (name, type, status, tags, etc.). Multiple filters are combined with AND logic.
Note: For surface-specific filtering (ENDPOINT, CLOUD, IDENTITY, NETWORK_DISCOVERY), use the list_inventory_items tool instead, which supports surface filtering via GET.
Args: filters: JSON string containing filter dictionary (optional, default: {}). Use REST API filter format with field names in camelCase.
Standard Filters (exact match - matches ANY value in list):
- {"resourceType": ["Windows Server", "Linux Server"]}
- {"assetStatus": ["Active", "Inactive"]}
- {"category": ["Server", "Workstation"]}
- {"infectionStatus": ["Infected", "Clean"]}
Contains Filters (partial match - case-insensitive):
- {"name__contains": ["prod", "test"]}
- {"cloudProviderAccountName__contains": ["production"]}
- {"osName__contains": ["Windows", "Ubuntu"]}
Range Filters (date ranges - use ISO date strings or millisecond timestamps):
- {"lastActiveDt__between": {"from": "2024-01-01", "to": "2024-12-31"}}
- {"lastActiveDt__between": {"from": 1704067200000, "to": 1735689599000}}
IMPORTANT: All datetimes in the Inventory API are in UTC timezone.
For timestamp-based date filters, you can use the iso_to_unix_timestamp tool
to convert ISO 8601 datetime strings to UNIX timestamps in milliseconds (UTC).
The iso_to_unix_timestamp tool handles timezone conversion automatically.
Provide datetimes in the user's preferred timezone (e.g., "2024-01-01T00:00:00-05:00" for Eastern Time)
and the tool will convert to UTC milliseconds for the API.
Example workflow for timestamp filters:
1. Call iso_to_unix_timestamp("2024-01-01T00:00:00-05:00") -> returns "1704085200000" (UTC)
2. Use in filter: {"lastActiveDt__between": {"from": 1704085200000, "to": 1735693199000}}
ID Filters (exact ID matches):
- {"id__in": ["uuid1", "uuid2", "uuid3"]}
Negation Filters (exclude values):
- {"assetStatus__nin": ["Decommissioned"]}
- {"resourceType__nin": ["Unknown"]}
Combining Filters (AND logic - all must match):
- {"resourceType": ["Windows Server"], "assetStatus": ["Active"], "name__contains": ["prod"]}
Common Examples:
- Find production servers: {"name__contains": ["prod"], "resourceType": ["Windows Server", "Linux Server"]}
- Find active AWS instances: {"cloudProvider": ["AWS"], "assetStatus": ["Active"]}
- Find recently active endpoints: {"lastActiveDt__between": {"from": "2024-12-01", "to": "2024-12-31"}}
limit: Number of items to retrieve (1-1000, default: 50).
skip: Number of items to skip for pagination (default: 0).Returns: Filtered list of inventory items in JSON format with pagination info. Returns empty list if no matches found.
Raises: ValueError: If filters JSON is invalid or parameters are out of range. InventoryAuthenticationError: If authentication fails. InventoryNetworkError: If network operation fails. InventoryAPIError: If the API returns an error. InventoryClientError: For other client-level errors.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| filters | No | ||
| limit | No | ||
| skip | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |