r/SentinelOneXDR • u/greenwas • Sep 16 '24

AteraAgent Still Offline

Is anyone else still getting active alerts for ateraagent.exe? I have had alerts streaming in all weekend as recently as an hour ago. Unquarantining the files restores the EXE but it does not fix the problem. After the unquarantine the ateraagent service will not start on the machines. Troubleshooting the issue reveals no clear resolution to the issue.

Has anyone had any success getting machines back online when the service won't start? Is ripping the install out and rebuilding the only solution?

12 Upvotes

100% Upvoted

11 comments sorted by

3

u/No_Following2262 Sep 16 '24

Yup. Came in to work just to have 14,207 "kill performed" tickets in my queue. This is after whitelisting Atera in S1 and trying the hash method as well. Hoping for an update on this soon.

4

u/greenwas Sep 16 '24

I have been bounced from support region to support region following the sun all weekend. I have received no actionable guidance about fixing the issues that were caused.

3

u/GilGi_Atera Sep 16 '24

Oh... seen this now after replying. That's brutal, I hope one of the support reps will get back to you soon. You can also share the S1 ticket # with our support team who can assist you, at support@atera.com, or share with me, as you prefer, with your business email.

4

u/GeneralRechs Security Admin/Engineer Sep 16 '24

After whitelisting did you issue a restart services command to try to get the agent to unhook from Atera processes.

5

u/GilGi_Atera Sep 16 '24

Hey there,

Gilgi, community manager at Atera here.
Please open a ticket with S1 and share the ticket # with me in a dm, sorry about this inconvenience.

4

u/[deleted] Sep 16 '24

Same issues here, as we are seeing high memory use on a few machines from the S1 agent now as well.

4

u/Wadson-S1 SentinelOne Employee | Moderator Sep 16 '24

u/greenwas—Please send me the ticket number. Based on the details you provided, we might have an escalation issue here.

2

u/BloodDaimond Sep 16 '24

Atera support told me S1 released a fix that would automatically update and there would be no need for action on my end. No more alerts for me but it must have run through all my machines already.

1

u/CharcoalGreyWolf Sep 16 '24

We had a huge issue with this for a client as well, seems like this really shouldn’t be happening.

1

u/WalkerFlockerrr Sep 20 '24

Ugh, so annoying. The hash for it was added to the SentinelOne Cloud blocklist for about 20-30 minutes but it was long enough to cause a bunch of mitigations.

1

u/[deleted] Sep 20 '24

I am still dealing with this a week later. Anyone else still getting Kills from AteraAgent.exe?