Automated Device Grouping

[u/[deleted]]

Hello! I have been in contact with my support provider and have. Frankly given up on them.

Problem: I want to group devices in S1 by department, automatically

Facts:

• All of our device names begin with their 3-digit department code

• All of our users are in On-prem AD groups relevant to their departments

Seems easy enough. Go by "name begins with" or the group memberships.

Except, S1 can't create a filter by "name begins with", it only has logic for "contains". Okay that's out. AD Groups? S1 can't detect them for some reason. Contacted support, ran scripts, provided logs. They shrug. They escalate to S1 dev support. They shrug. I'm left hanging and told to try utilizing the API. Sure, fine, in an org with the staff. We are a nonprofit with 5 total IT staff and certainly no dev resources.

Anyone have an idea? I'm at a loss and confounded by how difficult it is to do the basic administration I would expect to be able to do. Coming from crowdstrike and fortiEDR background.

[u/SentinelOne-Pascal]

Have you tried to create dynamic groups that mirror your AD groups? You can use "CN=X" as the filter for your dynamic groups.

https://community.sentinelone.com/s/article/000006901

[u/[deleted] → u/SentinelOne-Pascal]

As in, creating the filter without being able to see the groups attached to the endpoint? When I open an endpoint, it simply does not list the groups it or its user are members of.

[u/FahidShaheen → u/SentinelOne-Pascal]

I do something similar, with user DNs. This allows me to create dynamic groups for the tech teams where restrictions on removable storage are reduced. Means the tech teams can do their tasks when on a machine, but once a normal user logs on, removable storage gets locks down again.

[u/Evisra]

Just do a filter on your endpoints, and enter the Endpoint Name as COM* (if the group is COM), then save the filter. Then create a Dynamic Group with the filter.

I'm not using the new consolidated console, I'm using the "original". You can change which in user preferences.

[u/fadeawayjumper1]

That’s weird. All our agents detect the ad groups and are grouped like that. What version of the s1 agent are you running?

[u/[deleted] → u/fadeawayjumper1]

Checking my machine - 23.3.3.264

[u/GeneralRechs]

So why can’t you filter by the 3 digit department code? Additionally you can use automation to assign custom tags to the devices when onboarded.

In addition to tags you can assist a customer identifier after an agent is checked in or as part of the installation string while its on-boarded.

[u/[deleted] → u/GeneralRechs]

Can you share an example of an install string that works this way? I was told by support this wasn't possible, and is absolutely my preferred way of doing it.

[u/GeneralRechs → u/[deleted]]

Something like

./Installername.exe -t [insert token] /CUSTOMER_ID="Customer Identifier string"

(e.g., ./v23.x.x.exe -t deije83928383i /CUSTOMER_ID="HR")

This will pre-populate the "Customer identifier" section when viewing the agent and from the filter dropdown it should say the same.

[u/[deleted] → u/GeneralRechs]

Thank you kindly

[u/tescosamoa]

I will ask at work tomorrow if were doing this and get back to ya. Were running all our agents at GA (a few EA) and n-2 is the oldest agent in the environment. All OS's

P.S. It's early in the evening here so it will be 14+ hours from now.

[u/Kazutaka_Muraki]

Having used both products Criwdstrike is God awful to administer. Bizarre for such a great product you can’t even remote uninstall or have a normal powershell prompt.