Manage Sensors

Cybereason enables you to manage your Sensors from the API, including configuring NGAV settings for the sensors, starting and stopping collection on the Sensors, restarting Sensors, deleting or removing Sensors, archiving Sensors, and upgrading Sensors.

Tasks

All APIs assume a URL prefix of https://<your server>/rest.

Note

Click on any URI path to view more detailed information on a specific API request.

Task	Endpoint	Method	Returns
Get a list of all Sensors	sensors/query	POST	List of all Sensors and details
Retrieve a list of all actions on Sensors	sensors/allActions	GET	List of actions
Set the Anti-Ransomware mode for a Sensor	sensors/action/setRansomwareMode	POST	Batch ID and action details
Set the Application Control mode for a Sensor	sensors/action/setPreventionMode	POST	Batch ID and action details
Set the Anti-Malware status for a Sensor	sensors/action/set-antimalware-status	POST	Batch ID and action details
Set the Powershell protection mode for a Sensor	sensors/action/set-PowershellProtection-status	POST	Batch ID and action details
Start collection on a Sensor	sensors/action/startCollection	POST	Batch ID and action details
Stop collection on a Sensor	sensors/action/stopCollection	POST	Batch ID and action details
Delete a Sensor	sensors/action/delete	POST	Batch ID and action details
Remove a sensor from the Sensors list	sensors/action/purgeSensors	POST	Batch ID and action details
Restore a sensor removed from the Sensors list	sensors/action/revertPurgedSensors	POST	Batch ID and action details
Restart a Sensor	sensors/action/restart	POST	Batch ID and action details
Retrieve logs from a Sensor	sensors/action/fetchLogs	POST	Batch ID and action details
Download logs from a Sensor	sensors/action/download-logs/:batchID	POST	Log download
Download a CSV list of Sensors	sensors/download/csv	GET	Batch ID and action details
Upgrade the Sensor	sensors/action/upgrade	POST	Batch ID and action details
Abort in-progress operations	sensors/abort/:batchID	POST	Batch ID and action details
Archive a Sensor	sensors/action/archive	POST	Batch ID and action details
Remove a Sensor from archive	sensors/action/unarchive	POST	Batch ID and action details
Add/update or remove Sensor tags	tagging/process_tags	POST	List of Sensor Tags
Retrieve Sensor tags for a Sensor	sensors/tagging/:machineName	GET	List of Sensor Tags
Retrieve a list of sensor group	groups	GET	A list of sensor groups and group details
Create a sensor group	groups	POST	None
Edit a sensor group	groups/:group ID	PUT	None
Add a sensor to a sensor group	sensors/action/addToGroup	POST	Details about sensor update
Remove a sensor from a group	sensors/action/removeFromGroup	POST	Details about sensor update
Delete a sensor group	groups/:group ID	POST	Details about sensor delete operation
Start or end a full or quick scan on a Sensor	sensors/action/schedulerScan	POST	Batch ID and action details
Create a sensor policy	policies	POST	Details on policy creation object
Retrieve a list of sensor policies	policies	GET	List of sensor policy IDs and details
Retrieve settings for a single policy	policies/:policyID	GET	List of sensor policy fields and values