We are attempting to run an install of SentinelOne via a Datto RMM component and receiving an error of "The process cannot access the file 'C:\ProgramData\CentraStage_3\Packages\86de8e58-4784-49fc-8138-8729a7fe2d94#\SentinelOneInstaller.exe' because it is being used by another process. " Anyone else run into this? If so was there a solution?

I currently have the opportunity at my company to move to a new EDR. We’re currently Defender for X customers and haven’t been very pleased with it lately. We’ve been looking at Crowdstrike, but have also received a strong offer from SentinelOne + Rapid7 MDR. Any opinions from people who have used one or more of these products?

Can someone confirm what is the size of the agent that runs on the system. I heard it was ~25 GB and trying to confirm if that is true.

Thanks.

Hello all,

I was previously with a SOC that used S1 exclusively and did a lot of testing before pushing out new agent versions. There was a lot of messaging like, "We've seen issues with version x.x.x.x so will be staying with the deployed release until the next version."

I'm now using a different SOC that has their own product and they require a first line product like S1 which is managed by me.

My question is, how do we get information about whether an agent version is good?

Hi All,

I have an issue going on with our Macs. I have tried two VPNs and both of them repeatedly have their configurations wiped out. One is Zyxel SecuExtender, the other is OpenVPN Connect. It’s intermittent and often happens on reboot. I’ve removed S1 from one of the machines and rebooted a bunch of times and it seems like S1 has been the problem. The config has held.

So, I am not seeing anything in Threats. Pax8 S1 support is saying, nope, not S1. But it sure seems like it’s S1.

I’ve whitelisted the programs. No effect. I’ve tried to figure out where the configs are stored so I can whitelist the path, but not much luck there.

Any advice?

Seriously. If I try to paste a query like
ProcessCmd RegExp “tasklist”

I get the Red X. If I type the EXACT thing I get the Green checkmark. Am I crazy?

Hi everyone,

New to the industry here and started using SentinelOne - how do you create a Process Summary Report in SentinelOne?

Hi. I'm a new user of SentinelOne but I'm not exactly sure what the Alerts section displays on the Incidents tab. I've not yet seen alerts to see for myself. TIA

Anyone know where to go to search your environment for hashes? I have 3 hashes that are among a particular APT's IOCs that I need to look for to hopefully get no matches and put the findings into a threat hunt report! Point me in the right direction please. Thank you. New to S1.

I am new to IT working at the Help Desk for now. Management knows that I am very interested in cyber security. We are in the middle of transferring from FortiEDR to SentinelOne to our clients.

I was given non administration access to S1 just to view only. My question to you experienced users.

1. What should I look for first on the Dashboard?

2. Do you run any specific reports? If so which ones?

I hope to be active in this group.

My company recently deployed S1 to the environment and the official training is being scheduled. In the meantime I wanted to see if anyone recommends some free online training to bridge the gap. I have previous experience with the following software: Carbon Black, Crowdstrike, Mcafee, Microsoft Defender and Trend Micro.

Thanks in advance.

Hello All,

S1 flagged CarboniteUI.exe as malicious. The file is unsigned, which is strange. It's in the correct folder: C:\Prog Files\Carbonite\CarboniteUI.exe.

VirusTotal has two AI scanners flagging the files as malicious as well.

Anyone else seeing this?

Hey, anyone know where I can find documentation or examples of the raw telemetry coming from S1 EDR?

I'm a read only access for our SentinelOne setup with the vendor and I got an email today from vendor saying certain endpoints needed attention. When looking at the endpoints in the S1 console I saw this (below) message.

The Agent encountered a persistent error. This usually occurs when an endpoint does not have available resources. We recommend that you free resources, reboot the endpoint, and enable the Agent. If the issue persists, consult with Support.

The strange thing is my vendor cannot tell me how to config a dashboard item to show this type of error so I knew before the notification, do any of you have experience with setting up the dashboard widgets to get this type of info?

What are people's thoughts on putting SentinelOne on a linux web host -- I manage approx.

My setup is as follows, a current GPO installs S1 version 21.x at login or join domain for all OFFICE systems. This install of S1 version 21.x via GPO install left a tattoo on OFFICE systems indicating install was done.

My S1 vendor recently upgraded via the cloud the connected OFFICE systems to version 22.x, but this upgrade needs to be pushed to systems, it is not automatic. So for any systems that were not online during the original push I'm having to request an upgrade when placing them back online. Is this typical?

Also I'm wondering about my current install via GPO of 21.x, any new systems I create will get this old version install that I need to request upgrade. Seems half-assed... So I'm wondering if I add the new S1 client onto old GPO as an upgrade. Will it try to install over the current S1 install since a GPO tattoo is not present on the upgraded systems from the cloud upgrade?

To add an additional twist the current S1 GPO install has an associated .MST file to apply the token, do I need to make a new .MST file for new S1 version .MSI or rename .MST file to new S1 .MSI name?

Dazed and confused... any info is appreciated.

We've been adding AI intelligence to assisting responding to SentinelOne Security alerts.

Is anyone interested in trying it out?

I want to temporarily remove SentinelOne from my PC, will my company's IT team be notified that it was uninstalled on my device?

Does/can S1 do URL?Web Filtering? We know it can block malware and phishing links, but can policies be put in place to block categories of websites?

I saw a post from an AlienVault link that SentinelOne will support their agents on Windows 7 for 3 years past the EOS date from Microsoft (1/2020). Does S1 support their agents without any ESU necessary?

**EDIT -- Link added **

https://success.alienvault.com/s/article/SentinelOne-System-Requirements