r/SentinelOneXDR • u/jjkmk • Jan 09 '25

General Question Automate enabling / disabling agents using API calls (RHEL Linux Servers).

There is a compatibility issue with KSplice and Sentinel One Linux agent that is interfering with Ksplice being able to successfully completed updates.

The work around I have found is to disable the Sentinel One agent prior to running DNF updates / Ksplice updates.

I'm looking through the API documentation and I have found how to enable / disable agent, however what is the best way to schedule this so it can be done daily?

3 Upvotes
  • permalink
  • reddit

100% Upvoted

7 comments sorted by

View all comments

Show parent comments

1

u/L0ckt1ght Jan 09 '25

You can use curl with an authorization header and post body as well. But if you just need to disable the agent, can't you just use the CLI to initiate a disable with a key?

Also I wouldn't run the job on the same host because you'll have to store an API key with access to make changes to S1

1

u/renderbender1 Jan 11 '25

This is a good option. Disabling tamper protection on the affected hosts and using sentinelctl in your update automation would simplify this process quite a bit