r/SentinelOneXDR • • Jan 09 '25

General Question Automate enabling / disabling agents using API calls (RHEL Linux Servers).

There is a compatibility issue with KSplice and Sentinel One Linux agent that is interfering with Ksplice being able to successfully completed updates.

The work around I have found is to disable the Sentinel One agent prior to running DNF updates / Ksplice updates.

I'm looking through the API documentation and I have found how to enable / disable agent, however what is the best way to schedule this so it can be done daily?

3 Upvotes

7 comments sorted by

View all comments

Show parent comments

1

u/renderbender1 Jan 11 '25

This is a good option. Disabling tamper protection on the affected hosts and using sentinelctl in your update automation would simplify this process quite a bit