Search Users

Search users in your SentinelOne environment.

Options

Field Definition Type Required

Result Set

Choose a method to filter search results:

  • First Matching Record: Returns the first record that matches.

  • First 100 Matching Records: Returns the first 100 matching records.

  • Stream Matching Records: Passes all matching records from your parent flow to a helper flow.

    Selecting this option adds a Streaming input section to the card where you can select a helper flow for streaming and add custom extensible fields.

 Dropdown FALSE

Filter Type

Choose one of the following filter options to search for users where the selected attributes match:

  • Equal: The selected attributes are equal to the provided values.

  • Contains: The selected attributes contain the provided values.

  • Before: The selected attributes have a date earlier than the provided values.

  • After: The selected attributes have a date older than the provided values.

 Dropdown FALSE

Input

Field Definition Type Required

Sort

Sort Order

This field appears when you select First Matching Record or First 100 Matching Records from the Result Set option.

Indicate the sort order for the filtered results:

  • Ascending

  • Descending

Dropdown FALSE

Sort By

This field appears when you select First Matching Record or First 100 Matching Records from the Result Set option.

Sort the results by field:

  • ID

  • API Token Created At

  • API Token Expires At

  • Can Generate API Token

  • Created At

  • Date Joined

  • First Login

  • Email

  • Email Verified

  • Role ID

  • Last Login

Default sorting is based on the Created At field in the ascending order.

 Dropdown FALSE

Search Criteria

Email

The email address of the user.

Text FALSE

Account IDs

List of Text FALSE

Full Name

The full name of the user.

Text FALSE

Can Generate API Token

If true, the user can generate an API token.

True/False FALSE

Two Factor Authentication Enabled

If true, the user is configured for two-factor authentication.

True/False FALSE

Two Factor Authentication Statuses

The status of two-factor authentication of the user.

 List of Text FALSE

Date Joined

The date and time when the user joined.

Date & Time FALSE

Email Read Only

If true, the email cannot be modified.

True/False FALSE

Email Verified

If true, the email of the user is verified.

True/False FALSE

First Login

The date and time of the user's first login.

Text FALSE

Full Name Read Only

If true, the full name can't be modified.

True/False FALSE

Has Valid API Token

Indicates whether a valid API token exists.

True/False FALSE

Last Login

The date and time of the user's last login.

Date & Time FALSE

Primary Two Factor Authentication Method

The primary two-factor authentication method of the user.

Text FALSE

Role IDs

The unique identifier of the role.

List of Text FALSE

Site IDs

The unique identifier of the site.

List of Text FALSE

Source

The source of the user creation:

  • Active Directory

  • Global

  • Mgmt

  • SSO SAML

Dropdown FALSE

Query

Performs a search on the fields: Full Name, Email, and Description.

This field appears when you select Contains from the Filter option.

 Text FALSE

Created Before

The date and time when the user account was created.

This field appears when you select Before from the Filter option.

 Date & Time FALSE

API Token Expires Before

The date and time the API token expires.

This field appears when you select Before from the Filter option.

 Date & Time FALSE

Last Activation Before

The date and time the user's account was last activated.

This field appears when you select Before from the Filter option.

 Date & Time FALSE

Created After

The date and time after which the user account was created.

This field appears when you select After from the Filter option.

 Date & Time FALSE

API Token Expires After

The date and time after which the API token expires.

This field appears when you select After from the Filter option.

 Date & Time FALSE

Last Activation After

The date and time after which the user's account was last activated.

This field appears when you select After from the Filter option.

 Date & Time FALSE

IDs

Unique identifier of the user.

This field appears when you select First 100 Matching Records from the Result Set field and Equal from the Filter field.

 List of Text FALSE

Streaming

Flow

Click Choose Flow to browse and select a helper flow where the search results will be streamed, then click Choose to confirm.

Optionally, click the empty field under Click or drop here to create and add custom extensible fields that pass data to the helper flow. These fields are added as key/value pairs under the State output object in the helper flow.

This field appears when you select Stream Matching Records from the Result Set option.

Flow

 TRUE

Record Limit

Specify the number of records to stream.

  • The Record Limit field can't be set to 0. When it's is set to greater than 1, the stream returns up to the maximum number specified.

  • When the Record Limit field is empty, null, or not selected, the stream returns all records.

  • The default value is 500000.

  • The valid range is from 1 to 500000.

This field appears when you select Stream Matching Records from the Result Set option.

 Number FALSE

Output

Field Definition Type

Result

ID

Unique identifier of the user.

Text

API Token

Object

Created At

The date and time when the API token was created.

Date & Time

Expires At

The date and time when the API token expires.

Date & Time

Can Generate API Token

If true, the user can generate an API token.

True/False

Date Joined

The date and time when the user joined.

Date & Time

Agreed Eula

If true, the user has agreed to end-user license agreement (EULA) for their sites.

True/False

Agreement URL

A hyperlink to take the user to the end-user license agreement.

 Text

Email

The email address of the user.

Text

Email Read Only

If true, the email can't be modified.

True/False

Email Verified

If true, the email of the user is verified.

True/False

First Login

The date and time of the user's first login.

Date & Time

Full Name

The full name of the user.

Text

Full Name Read Only

If true, the full name can't be modified.

True/False

Global Organization ID

The global organization ID of the user.

Text

Global User ID

The global user ID of the user.

Text

Is System

If true, the user is a system account.

True/False

Last Login

The date and time of the user's last login.

Date & Time

Primary Two Factor Authentication Method

The primary two-factor authentication method of the user.

Text

Scope

The scope of the user.

Text

Scope Roles

List of Objects

Account Name

The account name that's associated with the user's scope.

Text

ID

The identifier of the scope that's assigned to the user.

Text

Name

The site name of the scope that's assigned to the user.

Text

Role ID

The identifier of the role that's assigned to the user.

Text

Source

The source of the user creation. The value is set to mgmt.

Text

Two Factor Authentication Configured

If true, the user is configured for two-factor authentication. .

True/False

Two Factor Authentication Enabled

If true, the user is enabled for two-factor authentication.

True/False

Two Factor Authentication Enabled Read Only

If true, the enabled status of two-factor authentication for the user can't be modified.

True/False

Two Factor Authentication Status

The status of two-factor authentication of the user.

 Text

Raw Output

The raw output returned by the SentinelOne API endpoint.

Object

Records Streamed

The number of records that are streamed in a streaming flow.

This field appears when you select Stream Matching Records from the Result Set option.

 Number