search_inventory_items
Search and filter SentinelOne managed assets by criteria such as name, type, status, or tags. Combine multiple filters with AND logic for precise results.
Instructions
Search for managed assets in SentinelOne using REST API filters.
Use this tool to find specific SentinelOne managed assets such as computers, servers, workstations, cloud resources, and network devices by various criteria (name, type, status, tags, etc.). Multiple filters are combined with AND logic.
Note: For surface-specific filtering (ENDPOINT, CLOUD, IDENTITY, NETWORK_DISCOVERY), use the list_inventory_items tool instead, which supports surface filtering via GET.
Args: filters: JSON string containing filter dictionary (optional, default: {}). Use REST API filter format with field names in camelCase.
Standard Filters (exact match - matches ANY value in list):
- {"resourceType": ["Windows Server", "Linux Server"]}
- {"assetStatus": ["Active", "Inactive"]}
- {"category": ["Server", "Workstation"]}
- {"infectionStatus": ["Infected", "Healthy"]}
Contains Filters (partial match - case-insensitive):
- {"name__contains": ["dev", "test"]}
- {"cloudProviderAccountName__contains": ["testing"]}
- {"osName__contains": ["Windows", "Ubuntu"]}
Range Filters (date ranges - use ISO date strings or millisecond timestamps):
- {"lastActiveDt__between": {"from": "2024-01-01", "to": "2024-12-31"}}
- {"lastActiveDt__between": {"from": 1704067200000, "to": 1735689599000}}
IMPORTANT: All datetimes in the Inventory API are in UTC timezone.
For timestamp-based date filters, you can use the iso_to_unix_timestamp tool
to convert ISO 8601 datetime strings to UNIX timestamps in milliseconds (UTC).
The iso_to_unix_timestamp tool handles timezone conversion automatically.
Provide datetimes in the user's preferred timezone (e.g., "2024-01-01T00:00:00-05:00" for Eastern Time)
and the tool will convert to UTC milliseconds for the API.
Example workflow for timestamp filters:
1. Call iso_to_unix_timestamp("2024-01-01T00:00:00-05:00") -> returns "1704085200000" (UTC)
2. Use in filter: {"lastActiveDt__between": {"from": 1704085200000, "to": 1735693199000}}
ID Filters (exact ID matches):
- {"id__in": ["uuid1", "uuid2", "uuid3"]}
Negation Filters (exclude values):
- {"assetStatus__nin": ["Decommissioned"]}
- {"resourceType__nin": ["Unknown"]}
Combining Filters (AND logic - all must match):
- {"resourceType": ["Windows Server"], "assetStatus": ["Active"], "name__contains": ["test"]}
Common Examples:
- Find testing servers: {"name__contains": ["test"], "resourceType": ["Windows Server", "Linux Server"]}
- Find active AWS instances: {"cloudProvider": ["AWS"], "assetStatus": ["Active"]}
- Find recently active endpoints: {"lastActiveDt__between": {"from": "2024-12-01", "to": "2024-12-31"}}
limit: Number of items to retrieve (1-1000, default: 50).
skip: Number of items to skip for pagination (default: 0).
fetch_fields: Field filtering. Either:
- Preset name: "MINIMAL", "STANDARD", or "ALL" (default: "MINIMAL")
* MINIMAL: 7 core fields (id, name, category, etc.) - fastest
* STANDARD: 13 fields (MINIMAL + operational context)
* ALL: All available fields (~200+ fields) - slowest
- List of specific field names in camelCase:
Examples: ["id", "name", "resourceType", "assetStatus"]
["id", "category", "osVersion", "ipAddress"]
Use fetch_fields="ALL" on a single item to discover all field names.
Defaults to "MINIMAL" for optimal performance with search operations.Returns: JSON string with filtered inventory items containing only requested fields. Field keys use camelCase format. Fields without values are excluded from the output. Includes pagination metadata. Returns empty list if no matches found.
Raises: ValueError: If filters JSON is invalid, parameters are out of range, or fetch_fields is invalid. InventoryAuthenticationError: If authentication fails. InventoryNetworkError: If network operation fails. InventoryAPIError: If the API returns an error. InventoryClientError: For other client-level errors.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| skip | No | ||
| limit | No | ||
| filters | No | ||
| fetch_fields | No | MINIMAL |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |