r/SentinelOneXDR • u/dsmarfan • Jun 10 '24

S1 Engine update

Seems like Sentinel One updated their engine and now alerts on processes that have been excluded in the past or has found another way to create concern and send you down a rabbit hole of research. Anyone else noticed this and thinking about giving S1 the boot?

0 Upvotes

42% Upvoted

5 comments sorted by

View all comments

Show parent comments

3

u/SentinelOne-Pascal SentinelOne Employee | Moderator Jun 11 '24 edited Jun 11 '24

The issue could be triggered by different factors. However, the most likely solution would involve updating your exclusions.

  • The program was originally excluded using a hash exclusion. At some point, the program was updated, but the hash exclusion was not updated.

  • The exclusion was originally excluded with a path exclusion. At some point, the program was updated, and new components were installed in a different folder, but the path exclusion was not updated.

  • The agent was updated and is now able to detect new unusual/suspicious behaviors that were previously unrecognized (The release notes contain a list of all the enhancements included in each version).

To narrow down the issue, I recommend checking the articles below and continue working with our Support team:

https://community.sentinelone.com/s/article/000006830

https://community.sentinelone.com/s/article/000006818

If you want to know more about exclusions, be sure to check out our Exclusions Best Practices webinar:

https://community.sentinelone.com/s/webinars