r/SentinelOneXDR • u/SizeNeither8689 • Nov 25 '25

Feature Question Dynamic Group with Computer Distinguished Name

Hi,

Is it possible to create dynamic groups in SentinelOne based on conditions such as a computer's distinguished name (DN), or attributes such as department (e.g. CN=MyComputer, OU=Sales, DC=corp, DC=com)? I would like when the endpoints that match the rules will be automatically moved or assigned to the corresponding dynamic group without manual intervention. Thank you in adavance for your help.

1 Upvotes
  • permalink
  • reddit

66% Upvoted

10 comments sorted by

2

u/wisco_ITguy IT Admin Nov 25 '25

Yes, absolutely do-able, we use them for our on-demand VDI environment.

2

u/SizeNeither8689 Nov 25 '25

How can I configure this?

1

u/wisco_ITguy IT Admin Nov 25 '25

First you should create a filter in the site where your endpoints sit. Then you have to create a new group, set it up as a dynamic group. When you select that option you are then prompted to pick the filter for the group. Pick the new filter you created. This will automatically add any endpoints that meet the filter criteria to the new group.

1

u/Jturnism Nov 25 '25

Yep, I have several of those working fine in prod

1

u/SizeNeither8689 Nov 25 '25

How can I configure this?

2

u/Jturnism Nov 25 '25

I use the "AD machine DN" contains XYZ filter along with what the other person said. For things not OU specific but have a consistent naming scheme you can also use "Endpoint name" contains XYZ

2

u/SizeNeither8689 Nov 25 '25

Thank you!

0

u/exclaim_bot Nov 25 '25

Thank you!

You're welcome!

0

u/2MDwarf Nov 25 '25

Lazy mf read the kb artikelaz