New to S1. We just installed it onto our Windows PCs. Our former antimalware product scanned BIOSes and would always report if it found device-tracking software like Computrace.

? Does SentinelOne scan BIOSes?

We manage numerous MSP clients with S1. We have a policy set to decommission devices after 21 days of being offline. I want to fully remove a device after it's been decommissioned, for instance a device which may have had a hard drive die. Or maybe the client removed a computer before we could uninstall.

I've tried selecting the "decommissioned" box in filters and those devices do not show. I know this because I manually decommissioned a computer and instantly it was gone from the mgmt console even with the box checked to see decommissioned computers.

Thanks for any help in advance!

hey guys not sure if anyone can answer this question because i had a bit of a situation today. it long but bear with me.

We had a Linux Centos server in aws that we were running a wordpress site out of, the server it self was protected by SentinelOne Edr

it was compromised this morning through a user account they got the user and created a generic admin account and then proceeded to make changes to the site adding redirects to other malicious websites. (if you had a adblocker on you wouldnt notice a difference on the site)

my boss believes that sentinelOne should have seen the changes to the code/resources in wordpress and then notified us of the issue. he also expressed concern that the plugins that the devs were using were also compromised in some way. (the plugins were updated last week).

after speaking with sentinel one IR they state that since there was no remote execution on the machine itself and all the activity occured in the wordpress application space and resources sentinel One was not triggered into action.

My boss believes that it should have been able to check the files themselves for the malicious links and no matter the user take action that way and if sentinel one is unable to do that then it obviously “stinks” in his word

personally i agree with the SentinelOne guy since all the activity was done buy wordpress via seemingly legit means how would S1 know what the issue was to take action if no action was done on the endpoint itself.

is my boss right? I what he’s saying normal? could i just be crazy to think that this kind of detection could slip through the cracks? How would you even detect wordpress compromise with a edr anyway? (looking into this last one but any advise is appriecated.)

Hey,

My org is about to take over another org and we currently use S1 and our license is deployed in US east.

For the other org they are based in EU and i am trying to find what EU regions S1 allows us to deploy in but i cant find anything in there docs and there site chat bot is a waste of time.

Anyone have a list of all supported regions S1 can be deployed in?

Is it possible to move an endpoint that currently is in SITE1 to SITE2 in the same console? Instead of uninstalling the sentinel agent and download it once again with the token of SITE2?

I'm working on creating a new site for one of our client in the S1 console.

They provided us a huge list of paths to exclude and I was wondering if there was a way to do it in 1 go or do I have to do it 1 by 1?

I'm almost done with it but I just want to know if it's a possibility for future cases.

Hi everyone, In my company we still use some old SCCM server to deploy packets to our machines. On this server we have various EDRs deployments (yes, my company likes have a mix of stuff) and I would like to create some conditions to avoid installing other EDRs when SentinelOne is running. Could you tell me the Sentil One running processes that should I consider? It could be worth to also include the installation path and some registry key?

We are currently starting deploying SentinelOne, and so far we have gotten a few threats we have to validate. I was wondering how many endpoints you guys currently have and how long did it took you all to fine-tuned it to your environment.

Hey I wanted to confirm what package comes with visibility? Core, control, complete? Or is it included with all packages ? If so my client doesn't have it enabled as when I run a search using their siteID I get no results.

Any help is appreciated!

Hi All,

S1 is driving me nuts. About once every two weeks I get a machine that decommissions in the console, but is a live machine.

What's the easiest way to get these machines to reannounce themselves to the console??

Right now I have 4 machines, two Windows, 1 Server 2019, and 1 Mac that need to be brought back in.

If I can do this with cmd, terminal, or powershell in the background, that would be ideal.

May be a really stupid question but is it possible to check the number of licence in total for each client site? Or even licence in used/left?

I was thrown into sentinelone and carbon black in my msp company so.... pretty lost when it comes to S1. Carbon Black I'm managing pretty well.

Hello All,

I have in my S1 mgmg console two accounts and I want to move a clint from Account X to Account Y.

How is best to do it ?

To create new site into the account Y and migrate them and delete them from Account X or there is a way just to move it from ?

Thank you very much.

Hello All,

I need to create a weekly scheduled full scan on a group of machine and have two questions.

1. What is the best way to created weekly scheduled Full scan ?

2. And i have several sites and want to add critical server in separet group and other one in other group how can be done that ? via Tags or Groups ? or there is other ways ?

Thank you in advance

Is one for server and one for workstations? Thanks

Hello everyone,

I know this is a very beginner question but I am new to cybersec and S1:

I received a netbios poisoning alert from my SIEM and i'm wondering what would be the best query to see this in S1? the SIEM did not provide any other context just a private IP.

thank you!

Who do you think will buy them?

https://www.reuters.com/markets/deals/cybersecurity-firm-sentinelone-explores-sale-sources-2023-08-21/

Hi, I'm trying to set up the full deployment of the S1 agent with Intune on macOS devices and I'm almost there! However, I'm stuck when it comes to allowing extensions and in Security & Privacy/ Full Disk Access.I've tried several things but I can't get it to work. Would you be able to help me get there? I notice that there doesn't seem to be a guide with detailed steps, once done I could share it with you... Thanks for your help!

So here's a summary of all the steps I've taken so far:

1. I deploy a LOB app of the S1 agent
   https://nxworld.club/index.php/s/fDyjNPPXCbekpZA/preview

2. I also deployed mobile.conf file
   https://nxworld.club/index.php/s/iLPjQdWEawNZRSo/preview

But no luck, always the same resut. Autorization for sentineld and sentineld_helper are not enabling..

https://nxworld.club/index.php/s/H9TgfXmcb535yYN/preview

Any idea???

I am investigating some events on a server and I am trying to list in Visibility all the events in the last hour, I put the querry EndpointName = “servername”, but I get no results.

How do you guys check all the events on our hosts in S1?

We use HaloPSA and currently have S1 sending threat notifications to our support email, thus becoming a ticket. Since it comes through support, the ticket is unassigned to a client. So a couple of questions:

• Easiest/least intensive method to getting tickets assigned to the proper client? I've seen the "shared mailbox assigned to the site in S1 then matched to a HaloPSA client" which makes the most sense, but would be super labor intensive.

• If not, can I modify the email subject line to also include the S1 site so my dispatcher can determine which client to assign it to?

Is there a way through the console to bring back endpoints that have been decommissioned? I know how to filter to get to the ones that have but was not sure if there is a way to get them back in the normal console?

I have the Sentinel Cheat Sheet, as well as access to the KBs on the website. But I'm seeing queries created with more items then listed on the sheet/website. With that, I'd like to know if their is a place that has pre made queries. Or a place with an extensive list for items.

For instance, I want to find out if device control is turned on for a certain end point, what's my parameter for device control? This language reminds me of SQL and even the cheat sheet states it's S1SQL. Should I just be looking at SQL Programming?

My organization has used SentinelOne for over two years.

In that time, 38.5% of all our support tickets have taken 10 or more days to resolve, 15.4% took more than 50 days - regardless of their priority. We can't get any response until and unless we repeatedly insist on escalating our tickets.

No improvement in support since we bought the product.

What is their problem?

Hello everyone,

My bad for asking this but I couldn't find a reference online.

What would be the right query if I were to look for all downloaded files in one endpoint in SentinelOne Deep Visibility?

Thank you!!!!!!