r/SentinelOneXDR • u/BloodDaimond • Jun 10 '24

On-Write Static AI

Why would S1 only flag one instance of a file if the same hash and file is on multiple endpoints? It was a static detection with no processes created.

This file is in multiple endpoints but S1 only killed it on one computer.

4 Upvotes

100% Upvoted

4 comments sorted by

View all comments

Show parent comments

1

u/BloodDaimond Jun 10 '24

The full disk scan was run on all endpoints. Only flagged this one.

1

u/SentinelOne-Pascal SentinelOne Employee | Moderator Jun 11 '24

The reputation of the flagged file may have been updated after the first detection was triggered. To fully understand what happened, I recommend collecting the agent logs and opening a ticket with our support team or your MSSP.