/inventory

name: "SentinelOne Inventory"
description: >
  SentinelOne's unified asset inventory across four surface types — agent-managed
  endpoints, AWS/Azure/GCP cloud resources, AD/Entra identities, and
  Ranger-discovered network devices. Covers the read-only inventory tools, the REST
  (not GraphQL) offset-pagination and filter model, asset field reference, and
  agent-coverage audit workflows.
when_to_use: >-
  When auditing asset coverage, agent health, or unmanaged devices in a SentinelOne
  environment. Use when: sentinelone inventory, sentinelone asset,
  sentinelone endpoint, sentinelone agent, sentinelone device, sentinelone workstation,
  sentinelone server, asset inventory, endpoint health, sentinelone cloud resource, sentinelone
  identity, sentinelone ranger, or network discovery.

SentinelOne Unified Asset Inventory

Overview

The SentinelOne unified asset inventory provides a single view of all assets across an organization's environment. Assets are categorized by surface type -- endpoints with SentinelOne agents, cloud resources in AWS/Azure/GCP, identity accounts from Active Directory and Entra ID, and network-discovered devices found by Ranger. For MSPs, the inventory is the foundation for security coverage -- ensuring every client device has an active agent, tracking cloud resource sprawl, and identifying unmanaged devices on client networks.

The inventory uses the **REST API** (not GraphQL), with offset-based pagination and direct filter parameters. All inventory tools are **read-only**.

Anti-triggers

• **Dedicated network discovery.** The `NETWORK_DISCOVERY` surface is

Ranger's passive by-product of the agents you already have. A question about scanning a subnet, fingerprinting an unmanaged device, or inventorying OT/IoT gear belongs to `runzero-assets`; live topology and interface state belong to `auvik-devices`.

• **What an endpoint detected.** This skill covers the asset record and

its agent health; findings on that asset are `sentinelone-alerts`, `sentinelone-vulnerabilities`, or `sentinelone-misconfigurations`.

• **A Huntress or ThreatLocker agent.** Different vendors' sensors are

different fleets with no shared record — use `huntress-agents` or `threatlocker-computers`.

MCP Tools

Available Tools

| Tool | Description | Key Parameters | |------|-------------|----------------| | `get_inventory_item` | Get a single inventory item by ID | `itemId` (required) | | `list_inventory_items` | List inventory items with filters | `surface`, `limit`, `offset`, `sortBy`, `sortOrder` | | `search_inventory_items` | Search inventory with REST filters | `filters`, `surface`, `limit`, `offset` |

List Inventory Items

Call `list_inventory_items` with optional parameters:

• **Filter by surface:** Set `surface` to `ENDPOINT`, `CLOUD`, `IDENTITY`, or `NETWORK_DISCOVERY`
• **Paginate:** Set `limit` (results per page) and `offset` (skip N results)
• **Sort results:** Set `sortBy` and `sortOrder`

**Example: List all endpoints:**

• `list_inventory_items` with `surface=ENDPOINT`, `limit=100`

**Example: List cloud resources:**

• `list_inventory_items` with `surface=CLOUD`, `limit=100`

**Example: List network-discovered devices:**

• `list_inventory_items` with `surface=NETWORK_DISCOVERY`, `limit=100`

Search Inventory Items

Call `search_inventory_items` with `filters` for targeted queries:

**Example: Search for a specific endpoint by name:**

• `search_inventory_items` with `surface=ENDPOINT`, `filters={"name__contains": "workstation-01"}`

**Example: Search for Windows servers:**

• `search_inventory_items` with `surface=ENDPOINT`, `filters={"osType": "WINDOWS", "machineType": "SERVER"}`

Get Inventory Item Details

Call `get_inventory_item` with the `itemId` to retrieve full details including agent status, OS information, network details, and security posture.

Key Concepts

Surface Types

| Surface | Description | Data Sources | |---------|-------------|-------------| | `ENDPOINT` | Managed endpoints with SentinelOne agents | Workstations, servers, laptops, VMs | | `CLOUD` | Cloud infrastructure resources | AWS EC2, Azure VMs, GCP instances, S3 buckets, etc. | | `IDENTITY` | User and service accounts | Active Directory, Entra ID (Azure AD), Okta | | `NETWORK_DISCOVERY` | Network-discovered devices (Ranger) | Switches, printers, IoT, unmanaged devices |

Endpoint Types

| Type | Description | |------|-------------| | `WORKSTATION` | Desktop or laptop workstation | | `SERVER` | Server (physical or virtual) | | `LAPTOP` | Laptop (may overlap with WORKSTATION) | | `VIRTUAL_MACHINE` | Cloud or on-premises VM | | `CONTAINER` | Container workload |

Agent Status

| Status | Description | |--------|-------------| | `ACTIVE` | Agent is running and communicating | | `INACTIVE` | Agent installed but not communicating | | `DISCONNECTED` | Agent has lost connection to the console | | `DECOMMISSIONED` | Agent has been decommissioned | | `PENDING` | Agent installation in progress |

REST API Pagination

The inventory uses offset-based pagination (unlike the cursor-based GraphQL tools):

| Parameter | Description | Default | |-----------|-------------|---------| | `limit` | Results per page | 50 | | `offset` | Number of results to skip | 0 |

To iterate through all results:

1. Call with `offset=0`, `limit=100` 2. If 100 results returned, call with `offset=100`, `limit=100` 3. Continue incrementing offset until fewer results than limit are returned

REST Filter Types

| Filter Type | Syntax | Description | |-------------|--------|-------------| | Exact match | `fieldName=value` | Direct value comparison | | Contains | `fieldName__contains=value` | Substring matching | | Greater than or equal | `fieldName__gte=value` | Minimum value (dates, numbers) | | Less than or equal | `fieldName__lte=value` | Maximum value (dates, numbers) | | Not equal | `fieldName__ne=value` | Exclude matches | | In list | `ids=id1,id2,id3` | Match multi