SentinelOne Inventory

SentinelOne Unified Asset Inventory

Overview

The SentinelOne unified asset inventory provides a single view of all assets across an organization's environment. Assets are categorized by surface type -- endpoints with SentinelOne agents, cloud resources in AWS/Azure/GCP, identity accounts from Active Directory and Entra ID, and network-discovered devices found by Ranger. For MSPs, the inventory is the foundation for security coverage -- ensuring every client device has an active agent, tracking cloud resource sprawl, and identifying unmanaged devices on client networks.

The inventory uses the REST API (not GraphQL), with offset-based pagination and direct filter parameters. All inventory tools are read-only.

MCP Tools

Available Tools

| Tool | Description | Key Parameters | |------|-------------|----------------| | get_inventory_item | Get a single inventory item by ID | itemId (required) | | list_inventory_items | List inventory items with filters | surface, limit, offset, sortBy, sortOrder | | search_inventory_items | Search inventory with REST filters | filters, surface, limit, offset |

List Inventory Items

Call list_inventory_items with optional parameters:

• Filter by surface: Set surface to ENDPOINT, CLOUD, IDENTITY, or NETWORK_DISCOVERY
• Paginate: Set limit (results per page) and offset (skip N results)
• Sort results: Set sortBy and sortOrder

Example: List all endpoints:

• list_inventory_items with surface=ENDPOINT, limit=100

Example: List cloud resources:

• list_inventory_items with surface=CLOUD, limit=100

Example: List network-discovered devices:

• list_inventory_items with surface=NETWORK_DISCOVERY, limit=100

Search Inventory Items

Call search_inventory_items with filters for targeted queries:

Example: Search for a specific endpoint by name:

• search_inventory_items with surface=ENDPOINT, filters={"name__contains": "workstation-01"}

Example: Search for Windows servers:

• search_inventory_items with surface=ENDPOINT, filters={"osType": "WINDOWS", "machineType": "SERVER"}

Get Inventory Item Details

Call get_inventory_item with the itemId to retrieve full details including agent status, OS information, network details, and security posture.

Key Concepts

Surface Types

| Surface | Description | Data Sources | |---------|-------------|-------------| | ENDPOINT | Managed endpoints with SentinelOne agents | Workstations, servers, laptops, VMs | | CLOUD | Cloud infrastructure resources | AWS EC2, Azure VMs, GCP instances, S3 buckets, etc. | | IDENTITY | User and service accounts | Active Directory, Entra ID (Azure AD), Okta | | NETWORK_DISCOVERY | Network-discovered devices (Ranger) | Switches, printers, IoT, unmanaged devices |

Endpoint Types

| Type | Description | |------|-------------| | WORKSTATION | Desktop or laptop workstation | | SERVER | Server (physical or virtual) | | LAPTOP | Laptop (may overlap with WORKSTATION) | | VIRTUAL_MACHINE | Cloud or on-premises VM | | CONTAINER | Container workload |

Agent Status

| Status | Description | |--------|-------------| | ACTIVE | Agent is running and communicating | | INACTIVE | Agent installed but not communicating | | DISCONNECTED | Agent has lost connection to the console | | DECOMMISSIONED | Agent has been decommissioned | | PENDING | Agent installation in progress |

REST API Pagination

The inventory uses offset-based pagination (unlike the cursor-based GraphQL tools):

| Parameter | Description | Default | |-----------|-------------|---------| | limit | Results per page | 50 | | offset | Number of results to skip | 0 |

To iterate through all results:

1. Call with offset=0, limit=100
2. If 100 results returned, call with offset=100, limit=100
3. Continue incrementing offset until fewer results than limit are returned

REST Filter Types

| Filter Type | Syntax | Description | |-------------|--------|-------------| | Exact match | fieldName=value | Direct value comparison | | Contains | fieldName__contains=value | Substring matching | | Greater than or equal | fieldName__gte=value | Minimum value (dates, numbers) | | Less than or equal | fieldName__lte=value | Maximum value (dates, numbers) | | Not equal | fieldName__ne=value | Exclude matches | | In list | ids=id1,id2,id3 | Match multiple IDs |

Field Reference

Core Inventory Fields

| Field | Type | Description | |-------|------|-------------| | itemId | string | Unique inventory item identifier | | name | string | Asset name/hostname | | surface | string | ENDPOINT/CLOUD/IDENTITY/NETWORK_DISCOVERY | | siteName | string | SentinelOne site (MSP client) | | accountName | string | SentinelOne account | | lastSeen | datetime | Last communication timestamp |

Endpoint-Specific Fields

| Field | Type | Description | |-------|------|-------------| | osType | string | WINDOWS/MACOS/LINUX | | osName | string | Full OS name (e.g., "Windows 11 Enterprise") | | osVersion | string | OS version string | | machineType | string | WORKSTATION/SERVER/LAPTOP/VIRTUAL_MACHINE | | agentVersion | string | SentinelOne agent version | | agentStatus | string | ACTIVE/INACTIVE/DISCONNECTED | | isUpToDate | boolean | Whether agent is on the latest version | | externalIp | string | External/public IP address | | internalIp | string | Internal/private IP address | | domain | string | AD domain membership | | lastLoggedInUser | string | Last logged-in user | | encryptionStatus | string | Disk encryption status | | firewallStatus | string | Firewall enabled/disabled |

Cloud-Specific Fields

| Field | Type | Description | |-------|------|-------------| | cloudProvider | string | AWS/AZURE/GCP | | region | string | Cloud region | | resourceType | string | Resource type (EC2, VM, S3, etc.) | | resourceId | string | Cloud resource identifier | | tags | object | Cloud resource tags |

Identity-Specific Fields

| Field | Type | Description | |-------|------|-------------| | identityProvider | string | AD/ENTRA_ID/OKTA | | email | string | User email address | | department | string | Department | | lastLogin | datetime | Last login timestamp | | mfaEnabled | boolean | Whether MFA is enabled | | accountStatus | string | Active/Disabled/Locked |

Network Discovery Fields

| Field | Type | Description | |-------|------|-------------| | deviceType | string | Discovered device type | | manufacturer | string | Device manufacturer | | macAddress | string | MAC address | | ipAddress | string | Discovered IP address | | managed | boolean | Whether a SentinelOne agent is installed | | firstSeen | datetime | When Ranger first discovered the device |

Common Workflows

Asset Audit

1. Call list_inventory_items with surface=ENDPOINT, limit=100
2. Paginate through all results using offset
3. Count by OS type, agent status, and machine type
4. Identify endpoints with inactive or disconnected agents
5. Identify endpoints with outdated agent versions

Endpoint Health Check

1. Call list_inventory_items with surface=ENDPOINT
2. Filter for agents not on the latest version: isUpToDate=false
3. Filter for disconnected agents: agentStatus=DISCONNECTED
4. Group by client (siteName) to identify which clients have unhealthy endpoints
5. Generate a health report with upgrade and reconnection recommendations

Cloud Resource Inventory

1. Call list_inventory_items with surface=CLOUD
2. Group by cloud provider and resource type
3. Count resources per client (siteName)
4. Identify resources not tagged according to client standards
5. Cross-reference with misconfigurations for exposed resources

Unmanaged Device Discovery

1. Call list_inventory_items with surface=NETWORK_DISCOVERY
2. Filter for managed=false to find devices