Feature Requst

[antmar904]

Hello again.

This PowerShell module is a life saver. I have another feature request but not sure if it's supported by the API. We do a lot of actions in bulk like fetch files, etc.

Would it be possible to add bulk actions for some of the commands like "Invoke-S1AgentFetchFile" and add a parameter called "AgentIDs" ?

I tried adding multiple agent ids comma delimited but it did not work.

here is the output:

PS C:\Users\user> Invoke-S1FetchFile -AgentID 1865915405318312837,1393562905710383536 -FilePath C:\temp\hostnames.txt
Invoke-S1FetchFile: Cannot process argument transformation on parameter 'AgentID'. Cannot convert value to type System.String.

[davidhowell-tx]

Apologies, I no longer have access to a SentinelOne account so am unable to verify.

However, I did my best to write the commandlets to match the API. So if the API supported multiple values (i.e. multiple Agent IDs) my goal was to implement that capability in code by allowing you to supply multiple values (comma separated). For any API calls that didn't allow for multiple inputs, I would've need to abstract away the process of submitting multiple API calls underneath, and I was aiming to simplify.

I believe the way I was solving this problem was to use a for-each loop

$ComputerNames = "PC1", "PC2", "PC3", "PC4"
ForEach ($Computer in $ComputerNames) {
Get-S1Agent -Name $Computer | ForEach-Object { Invoke-S1FetchFile -AgentID $_.Id -FilePath "C:\path\to\suspicious\file.dll" -Password "ZipPassword" }
}

I can't test the exact syntax anymore, but I believe that is accurate.

[antmar904]

Hi and thank you again for developing the PS module and your efforts. Ill test out the for-loop and let you know!

[antmar904]

That worked, after I contacted support so they can enabled the "FetchFile" API. Thanks again!