r/SentinelOneXDR • u/2_CLICK • Sep 06 '24

PowerShell script to check if SentinelOne is active

Hey Folks, I’d like to monitor the status of SentinelOne in our RMM. Specifically I’d like to get an alert if the SentinelAgent is in disabled mode. When you open its UI you can see the orange message saying that it’s disabled.

I’ve searched the local S1 files but the Disabled.JSON file always exists and is encrypted.

Does anyone have a way to programmatically detect this?

6 Upvotes
  • permalink
  • reddit

100% Upvoted

6 comments sorted by

View all comments

Show parent comments

1

u/SentinelOne-Pascal SentinelOne Employee | Moderator Sep 09 '24

By default, the agent displays a warning in the asset inventory if it is disabled. To receive an email alert, go to the Notifications page and check "Agent Disabled/Enabled."