SentinelOne Inventory

SentinelOne Unified Asset Inventory

Overview

The SentinelOne unified asset inventory provides a single view of all assets across an organization's environment. Assets are categorized by surface type -- endpoints with SentinelOne agents, cloud resources in AWS/Azure/GCP, identity accounts from Active Directory and Entra ID, and network-discovered devices found by Ranger. For MSPs, the inventory is the foundation for security coverage -- ensuring every client device has an active agent, tracking cloud resource sprawl, and identifying unmanaged devices on client networks.

The inventory uses the REST API (not GraphQL), with offset-based pagination and direct filter parameters. All inventory tools are read-only.

Anti-triggers

• Dedicated network discovery. The NETWORK_DISCOVERY surface is Ranger's passive by-product of the agents you already have. A question about scanning a subnet, fingerprinting an unmanaged device, or inventorying OT/IoT gear belongs to runzero-assets; live topology and interface state belong to auvik-devices.
• What an endpoint detected. This skill covers the asset record and its agent health; findings on that asset are sentinelone-alerts, sentinelone-vulnerabilities, or sentinelone-misconfigurations.
• A Huntress or ThreatLocker agent. Different vendors' sensors are different fleets with no shared record — use huntress-agents or threatlocker-computers.

MCP Tools

Available Tools

List Inventory Items

Call list_inventory_items with optional parameters:

• Filter by surface: Set surface to ENDPOINT, CLOUD, IDENTITY, or NETWORK_DISCOVERY
• Paginate: Set limit (results per page) and offset (skip N results)
• Sort results: Set sortBy and sortOrder

Example: List all endpoints:

• list_inventory_items with surface=ENDPOINT, limit=100

Example: List cloud resources:

• list_inventory_items with surface=CLOUD, limit=100

Example: List network-discovered devices:

• list_inventory_items with surface=NETWORK_DISCOVERY, limit=100

Search Inventory Items

Call search_inventory_items with filters for targeted queries:

Example: Search for a specific endpoint by name:

• search_inventory_items with surface=ENDPOINT, filters={"name__contains": "workstation-01"}

Example: Search for Windows servers:

• search_inventory_items with surface=ENDPOINT, filters={"osType": "WINDOWS", "machineType": "SERVER"}

Get Inventory Item Details

Call get_inventory_item with the itemId to retrieve full details including agent status, OS information, network details, and security posture.

Key Concepts

Surface Types

Endpoint Types

Agent Status

REST API Pagination

The inventory uses offset-based pagination (unlike the cursor-based GraphQL tools):

To iterate through all results:

1. Call with offset=0, limit=100
2. If 100 results returned, call with offset=100, limit=100
3. Continue incrementing offset until fewer results than limit are returned

REST Filter Types

Field Reference

Core Inventory Fields

Endpoint-Specific Fields

Cloud-Specific Fields

Identity-Specific Fields

Network Discovery Fields

Common Workflows

Asset Audit

1. Call list_inventory_items with surface=ENDPOINT, limit=100
2. Paginate through all results using offset
3. Count by OS type, agent status, and machine type
4. Identify endpoints with inactive or disconnected agents
5. Identify endpoints with outdated agent versions

Endpoint Health Check

1. Call list_inventory_items with surface=ENDPOINT
2. Filter for agents not on the latest version: isUpToDate=false
3. Filter for disconnected agents: agentStatus=DISCONNECTED
4. Group by client (siteName) to identify which clients have unhealthy endpoints
5. Generate a health report with upgrade and reconnection recommendations

Cloud Resource Inventory

1. Call list_inventory_items with surface=CLOUD
2. Group by cloud provider and resource type
3. Count resources per client (siteName)
4. Identify resources not tagged according to client standards
5. Cross-reference with misconfigurations for exposed resources

Unmanaged Device Discovery

1. Call list_inventory_items with surface=NETWORK_DISCOVERY
2. Filter for managed=false to find devices without SentinelOne agents
3. Group by client (siteName) and device type
4. Generate a list of unmanaged devices for agent deployment

Identity Inventory

1. Call list_inventory_items with surface=IDENTITY
2. Check for accounts without MFA enabled
3. Identify stale accounts (no login in 90+ days)
4. Group by identity provider and department
5. Generate an identity hygiene report

Client Coverage Report

1. For each client, query all four surfaces: ENDPOINT, CLOUD, IDENTITY, NETWORK_DISCOVERY
2. Count managed vs. unmanaged assets
3. Calculate coverage percentage
4. Identify gaps in agent deployment
5. Present as a security coverage dashboard for QBR

Response Examples

Endpoint Inventory Item:

{
  "itemId": "inv-endpoint-001",
  "name": "ACME-WS-042",
  "surface": "ENDPOINT",
  "siteName": "Acme Corporation",
  "osType": "WINDOWS",
  "osName": "Windows 11 Enterprise",
  "osVersion": "23H2",
  "machineType": "WORKSTATION",
  "agentVersion": "24.1.2.345",
  "agentStatus": "ACTIVE",
  "isUpToDate": true,
  "externalIp": "203.0.113.10",
  "internalIp": "192.168.1.42",
  "domain": "acme.local",
  "lastLoggedInUser": "jsmith",
  "lastSeen": "2026-02-24T10:00:00.000Z",
  "encryptionStatus": "ENCRYPTED",
  "firewallStatus": "ENABLED"
}

Network Discovery Item:

{
  "itemId": "inv-ranger-005",
  "name": "Unknown Device",
  "surface": "NETWORK_DISCOVERY",
  "siteName": "Acme Corporation",
  "deviceType": "Network Printer",
  "manufacturer": "HP",
  "macAddress": "AA:BB:CC:DD:EE:FF",
  "ipAddress": "192.168.1.200",
  "managed": false,
  "firstSeen": "2026-02-20T14:00:00.000Z",
  "lastSeen": "2026-02-24T09:30:00.000Z"
}

Error Handling

Common Errors

Best Practices

1. Always specify surface type - Filter by ENDPOINT, CLOUD, IDENTITY, or NETWORK_DISCOVERY for focused results
2. Monitor agent health - Regularly check for INACTIVE or DISCONNECTED endpoints
3. Track unmanaged devices - Use NETWORK_DISCOVERY to find devices without agents
4. Scope to clients - Filter by siteName when reviewing a specific client's inventory
5. Check agent versions - Identify endpoints with outdated agents for upgrade scheduling
6. Cross-reference with alerts - Use inventory data to enrich alert investigations with asset context
7. Paginate consistently - Use offset-based pagination for large inventories
8. Cache inventory data - Asset data changes less frequently than alerts; cache for short periods
9. Generate coverage reports - Calculate agent deployment coverage per client for QBRs
10. Identify shadow IT - Network-discovered devices may reveal unauthorized equipment

Related Skills

• Alerts - Alerts affecting inventory assets
• Vulnerabilities - Vulnerabilities on inventory endpoints
• Misconfigurations - Misconfigurations on inventory resources
• API Patterns - MCP tools reference and REST API details
• Purple AI - Investigate threats on specific assets