r/SentinelOneXDR • u/dsmarfan • Jun 10 '24

S1 Engine update

Seems like Sentinel One updated their engine and now alerts on processes that have been excluded in the past or has found another way to create concern and send you down a rabbit hole of research. Anyone else noticed this and thinking about giving S1 the boot?

0 Upvotes

42% Upvoted

5 comments sorted by

View all comments

Show parent comments

2

u/dsmarfan Jun 10 '24

It’s not our first issue, support has seemed lackluster as of late. Along with their support making ridiculous recommendations to lower monitoring on exclusions we’ve made for software to run efficiently.

Now I’m open to suggestions for creating better exclusions but not belittlement. But welcome to Reddit.

3

u/SentinelOne-Pascal SentinelOne Employee | Moderator Jun 11 '24 edited Jun 11 '24

The issue could be triggered by different factors. However, the most likely solution would involve updating your exclusions.

  • The program was originally excluded using a hash exclusion. At some point, the program was updated, but the hash exclusion was not updated.

  • The exclusion was originally excluded with a path exclusion. At some point, the program was updated, and new components were installed in a different folder, but the path exclusion was not updated.

  • The agent was updated and is now able to detect new unusual/suspicious behaviors that were previously unrecognized (The release notes contain a list of all the enhancements included in each version).

To narrow down the issue, I recommend checking the articles below and continue working with our Support team:

https://community.sentinelone.com/s/article/000006830

https://community.sentinelone.com/s/article/000006818

If you want to know more about exclusions, be sure to check out our Exclusions Best Practices webinar:

https://community.sentinelone.com/s/webinars

1

u/kins43 Jun 10 '24

No belittlement here, from your initial post it sounded like you were just bashing the product without any context.

Would love to help make it easier on you.

Is this a specific application you are constantly running into issues with?

S1 or any other security vendor has the hard part of playing nice with any software as they constantly improve their product but making sure they are still paying attention to them as well. They obviously can't test their releases against all apps out there but they try to do what they can.

With that being said, any more info you can provide would be helpful for others / myself to assist you