s1_agents
List and filter endpoint agents to monitor machine health and status. Drill down into OS, site, and last active details.
Instructions
List endpoint agents with filters — the drill-down tool for machines. Returns each agent's computer name, site, OS, agent version, online/infected/up-to-date status, last active date, last logged-in user and network status. Filter by site, name, health flags or OS. Returns a compact summary per agent by default; set full_details=true for complete raw records (large). Call s1_list_sites first to resolve site IDs.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max records per response (default 25, max 1000). | |
| cursor | No | Pagination cursor: pass the nextCursor from the previous response to get the next page. | |
| infected | No | Only agents with (true) or without (false) unresolved threats | |
| os_types | No | Comma-separated OS types: "windows", "macos", "linux", "windows_legacy" | |
| site_ids | No | Comma-separated site IDs to scope to (sites are how clients are segmented) | |
| is_active | No | Online status: true = online now, false = offline | |
| full_details | No | Return complete raw agent records instead of the compact summary. Default false. | |
| computer_name | No | Filter to computer names containing this text | |
| is_up_to_date | No | false = agents whose SentinelOne agent software needs updating | |
| machine_types | No | Comma-separated machine types: "desktop", "laptop", "server", "kubernetes node", "unknown" | |
| reboot_required | No | true = agents waiting on a reboot to complete threat mitigation | |
| network_statuses | No | Comma-separated: "connected", "disconnected", "connecting", "disconnecting" | |
| last_active_after | No | Only agents last active after this ISO 8601 datetime | |
| last_active_before | No | Only agents last active before this ISO 8601 datetime (find stale machines), e.g. "2026-07-01T00:00:00Z" |