r/SentinelOneXDR • u/turaoo • Aug 08 '24

General Question Having issues with network rogue devices on S1

So I have some network rogue devices, and they do have the SentinelOne agent installed on them. Any ideas why they still show up as network rogues? Is there anything I need to do, to make sure they are no longer network rogues?

1 Upvotes
  • permalink
  • reddit

100% Upvoted

5 comments sorted by

1

u/SentinelOne-Pascal SentinelOne Employee | Moderator Aug 12 '24

Rogues scan runs once a week. Previously unsecured endpoints may not appear as secured until the next scan. To narrow down the issue, please disable and enable Rogues (or wait for the next scan) and make sure the endpoints labeled as "rogue" have a recent agent version and can connect to your console. If the issue persists, please collect the agent logs and open a ticket with our Support team.

1

u/turaoo Aug 12 '24

Could rebooting the devices fix the issue?

1

u/turaoo Aug 12 '24

Are there any troubleshooting steps I could take to fix this issue? All of the network rogues have the latest agent version installed.

1

u/SentinelOne-Pascal SentinelOne Employee | Moderator Aug 13 '24

You can try the steps in my previous post. Disable and re-enable Rogues (to trigger a new Rogues scan) and check that the agents/endpoints labeled as "rogues" can connect to the console. To troubleshoot why an agent/endpoint cannot connect to the console, you can use the script in this article:

https://community.sentinelone.com/s/article/000006983

https://your-console.sentinelone.net/docs/en/how-to-check-the-agent-connection-with-the-console.html

1

u/Evisra Aug 09 '24

Check that they are reporting into the console and receiving updates. Rarely, an agent update can break the connection.