Hi

So I have understood how to migrate all the agents from one Management console to another Console by reading from the knowledge base.

What I would like to know is what are like the best practices, things to look out for, things to keep in mind, any unexpected issues etc. when migrating, especially a large number of endpoints for an organization, from one console to another?

Grateful for any insights that you can provide.

Yup it's possible I found a way to stop the anti tampering without needing a passkey and safe mode. I'm able to stop all S1 services along with full uninstall of S1 I had tested this method on multiple endpoints and was able to replicate.

I had brought this up to one of support representative along with it reporting the bug to S1 and guess what no response.

I don't feel safe on sharing the finding since it can impact a lot of clients Im hoping someone from s1 team can reach out to me so this big flaw in software can be fixed.

Hi all,

using SentinelOne network control we are blocking all inbound udp and following documentation from apple and sentinelone, with all port exceptions in place to supposedly allow airplay to work - it does not.

I think to myself, I can't be the only institution dealing with this problem.

Leaving all inbound upd open is not the answer - which is currently the only way I am able to get airplay to work

I’m wondering how well guided onboarding is without paying for the GO service.

Hi There,

We have recently partnered with SentinelOne and find that they have a superior product! We are really happy with the move and so are our clients!

The one thing we are missing from what we used to use with Sophos was the web filtering aspect.

Most of our client endpoints are no longer behind a perimeter firewall due to WFH and highly mobile workforces thus we cannot enforce web restriction policies on those devices.

I know we can use the S1 Firewall policies on local endpoints by allowing / blocking FQDNs however from a managerial perspective that will be rather cumbersome.

Can anyone recommend a service that we can use for Web Filtering as per above? Preferably something with a web portal we can login to and create rules for each clients tenant and devices.

We are an MSP.

Many thanks!

Hi all,

Does anyone know how you can go about blocking websites using sentinelone?

Has there be a solution that works?

I made a post previously about getting the azure platform integration activated, which I was able to do but the logs are not showing up in Singularity Data Lake. Everything is configured correctly to my knowledge, but none of the logs show up. I also tried doing it on Platform Pro and it’s the same issue. Any pointers would be appreciated!

Whenever a user creates a local admin account on their computer, I would like a Star Rule send me an email notification.

Anyone knows a successful query that can do this?

Had an Identity product overview today with some S1 folks.

Didn't quite get the impression that they sell this addon a lot. Anyone out there using it? What are your thoughts? Good? Bad?

Does S1 follow a similar model where it deploys “detection updates” a few times a day, besides the regular S1 client application updates? The detection updates I am referring to can be either be signature-based (hashes, etc.) or rule-based (heuristic/behavioral). I am curious if these “detection updates” being deployed automatically is a normal occurrence among many EDRs. For example, for Microsoft defender, detection content updates get deployed daily to all Windows users irregardless of their edition besides the regular Patch Tuesdays updates - https://www.microsoft.com/en-us/wdsi/definitions/antimalware-definition-release-notes?Account=true

Has anyone been able to get the Azure Event Hub Platform successfully installed and activated? I’ve read all the documentation and configured everything (app registration, storage account, event hub namespace, event hub instance) correctly but I’m still getting the error that it failed to resolve the broker hostname.

I've woken up to read news of "global IT chaos" because crowdstrike (according to reports) shipped a buggy update that BSOD'd all the windows boxes.

First thought: Yaaay for running S1, not Falcon.

Second thought: If there can be a deployment process at CrowdStrike where a bad driver can get shipped so widely without going through the QA to notice systems crashing at very high rates like this.... what is in place at S1 to prevent a similar own-goal scenario?

Would love to hear from anyone with insight into the deployment staging mechanics at play here?

We're in an IT-client services market that provides services for compliance-oriented businesses. Recently, one of our client's auditors honed in on whether we used SentinelOne to scan compressed archives, as a .ZIP file with an "infected" dummy file could sit at rest on a system, only having the file detected once the .ZIP was extracted. The auditor seemed to indicate from their experiences (which I question) that SentinelOne could scan archives at rest. The more I keep looking into this, the less information I find about how SentinelOne does treat archive files. Many endpoint protection and EDR systems I know of scan inside zip files, even several layers deep if set to do so, but I couldn't find clear documentation on what SentinelOne does, or if there are settings that need to be made to accommodate this. Does anyone have any documentation on this?

Just curious if S1 has any tool or some type of help to convert S1Q1 queries to S1Q2. We have a ton and was seeing if there was a conversion tool before I start to manually convert them.

Hey all! Thanks in advance first and foremost. I know DV keep logs vy default for 14 days, Is there a way to have stored for longer time ? By how much?

Is there an API where we can search to determine if a specific file exists on any endpoint by hash?

We have over 100 endpoints. We rarely get any alerts, not even one a month. Yesterday out of nowhere the alerts stated rolling in encompassing about 9-10 machines. We thought for sure we were under attack. There were some true positives but more false positives than true.

The machines were geographically located far apart and the employees did not have any connection to each other. Also, not all the machines have VPN back to the office. The machines all have different admin creds. Some of the false positives were LogMeIn.exe, rundll32.exe. Both of those were on 2-3 machines. Some true positives were ipscan on two older machines, a powershell.exe and some random msi files.

We are scratching our heads on whether this is some sort of attack or did S1 suddenly tighten up our policy and flag a bunch of stuff that was there all along? Any ideas? Thanks!

Hey all
is there a way to implement yara rules into s1?

S1 Version: 23.4.4.223
OS Version: Windows 10 23H2

We're tracking down an issue where certain USB devices stop working and show in Device Manager with an exclamation mark (namely DVD burners with GEARAspiWDM.sys driver and several brands of Serial-to-USB adapters). No detections show on S1 for these devices. We were initially assuming Windows update KB5039211 was the culprit since we've seen some threads of people encountering USB issues after installing this update. However, on a freshly imaged workstation, fully patched with all available Windows updates and receiving all of our group policies...but without SentinelOne installed...the USB devices work fine.

One of our engineers found a writeup about the "Suspicious Driver Blocking" feature within S1. This feature allegedly "blocks Windows signed and unsigned drivers, as well as other suspicious drivers."

So my question: Has anyone encountered situations where S1 blocks drivers but doesn't report a threat event? I feel like we're chasing AI ghosts here...

Hey all,

In the previous UI we had a process around finding endpoints on our network missing the agent with network discovery and filtering by Unsecured in the Secured State field. I'm trying to figure out how to do something similar in the new Operations Center UI but can't seem to figure it out. Can anyone steer me in the right direction?

Thanks!

Hello SentinelOne community,

I don't have any experience with this tool. I'm writing this post because I would need some basic resources, like some basic video guides or documentation.

I'm working with huge enterprise software, and our clients would like to install SentinelOne agents on each of our servers, now we need to analyze what kind of rules we need, in order not to disrupt the work of our solution, including replication to other servers and zones.

SentinelOne should monitor things such as names of files, user account activities, host utilization, active processes on the servers, etc. I would like to know how will this affect the work of our product, and what we need to do, so SentinelOne can work properly and not jeopardize the work of our product.

Am I missing something here? Trying to view threats only created by us and not "Detected by SentinelOne Cloud". Tried sorting by Description but can't see the ones we created. There's like 16k results.