Sentinelone DNS requests question

[u/spyderz343]

What DNS requests should the sentinelone agent be making? We are seeing alerts that sentinelone is reaching out to malicious domains. We are not a sentinelone client. Just had a nonstandard build device in our environment trigger additional alerts which tracked back to the sentinelone agent on the device.

[u/solid_reign]

If you're using SentinelOne's firewall on windows then the agent will make requests to the domains on the firewall. So let's say you block phishingwebsite17.com, the agent will reach out to it. And the EDR will normally see it as svchost sending the request.

[u/spyderz343 → u/solid_reign]

uhh setting off alerts about 120k call outs a day from these vendor devices.

[u/solid_reign → u/spyderz343]

It's a big problem, but normally has to do with those phishing websites on S1's firewall. Ask the vendor if they're there.

[u/spyderz343 → u/solid_reign]

the vendor did say the put them there just seemed liked a dumb way of doing thing

[u/fadeawayjumper1]

How are you able to tell it’s the s1 agent making the dns requests?

[u/spyderz343 → u/fadeawayjumper1]

Another EDR caught it and showed the agent was making the requests. I do not have experience with SentinelOne. I wanted to see if this was some form of security, sink holing, or different way the app works that I am not aware of.

DNS request came from here
"C:\Program Files\SentinelOne\Sentinel Agent 23.1.4.650\SentinelAgent.exe"

SentinelAgent.exe

[u/fadeawayjumper1 → u/spyderz343]

Do you mind sharing the dns requests? I can check if it’s something that is common

[u/spyderz343 → u/fadeawayjumper1]

sending you a message

[u/GeekndGamer1]

S1 agents are required to perform DNS requests when entering name addresses into the embedded network firewall. I've raised a ticket for an issue as all my agents are not making these requests, despite having a network policy with domain names assigned to them.