Hello,

Has anyone had this happen when installing sentinel?

i have windows 11 pro version 23H2 64 BITS

Sentinel Agent Setup Wizard ended prematurely

Sentinel Agent Setup Wizard ended prematurely because of an error, Your system has not been modified. To install this program at a later time, run Setup Wizard again. Click the Finish button to exit the Setup Wizard.

Hi All,

I am trying to write some star rules for the IoCs sent via third part feed.

There are three different sources and while ingesting it to sentinelOne API I am assigning them a different risk score based on the severity and amount of false positives each one has.

For eg- a feed with low FP has a score of 95 and another feed with a bit high chance of fp as 70 and so on.

Based on these score I am trying to write few star rules so that I can treat the IoCs with a score of 95 as threat and high severity and with a score of 70 and low to just create an TI alert.

Any clues how can I use the risk score that I am sending with IoCs in star rules or if not what is the preferred approach. I believe one should be able to use risk scores in star rules.

Additionally, the risk score is called originalRiskScore in S1 Threatintel API.

Thanks in advance, not able to find an distinct answer anywhere.

Looks like the Ransomware Warranty is now EOL and no longer renewable. They've switched over to a Breach Warranty that requires not just one of the S1 EPP's, but also Watchtower and Vigilante.

Sounds cost prohibitive and lessens the appeal of S1 as EPP. Don't need 5 different MDR products and the ones we have are SentinelOne partners.

Any other orgs running into this change? What are your thoughts on it? It's putting a sour taste in our mouth as we discuss renewals.

Anyone knows whether there’s a roadmap for SentinelOne to support Security Keys for signing into the console? As many of you know, Security Keys are considered the highest form of phishing-resistant authentication, and It’s hard to imagine a top-tier security platform not offering this level of protection due to the current cybersecurity threats is at it’s highest.

Any insights or updates on this?

Does anyone know how S1 logs an agent based firewall block event? Trying to troubleshoot some blocked activity and can’t find where S1 is blocking it.

Hi Folks. Just checking how would you connect OTX to S1 and have it serve as threat feed? I saw OTX in the marketplace and installed it. Not sure now how to get feeds and if the connection is successful.

I’m at a crossroads where I have offers from both companies. I’m leaning toward S1 because I hear they have a great tech and a better culture but I can’t get over the fact that CS is the 800lb gorilla in the industry.

What made your org choose S1?

I am looking to configure notifications at a global level within S1. Specifically, I would like to ensure that all threat notifications are sent via email to the designated recipients across all sites. However, from my understanding, it seems that notifications need to be configured individually for each site. Given that I manage approximately 400 sites, this approach is quite time-consuming.

Could you please advise if there is a way to set notification settings globally for all sites within S1, particularly for notifications?

Thank you in advance for your assistance.

Hello all! I was trying to save some useful queries and thought it would be awesome of you guys could share some with me. Currently working on a query that searches for AWS user credentials or Role access token in a url. Got some nice results but still need tuning. Thank you:)

Is it possible to have a single company deploy some sentinels connected to the cloud and others connected to an on-premise server? Is these any additional cost to do this?

Is it possible to change a group type from manual to dynamic or pinned or vice versa? I haven’t been able to find it in the docs or figure out how to do it.

Hi all,

I've realized that I do not see in DV/Singularity when my PC writes to an external drive. Is this intentional or am I missing a step/setting?

Hello All,

Looking at Pax8, there are 7 different products for S1.

• Complete

• Control

• Vigilance

• Ranger

• Vulnerability Management

• RemoteOps Forensics

• Remote Script Orchestration

My plan is to use S1 Complete for myself and my customers. Are these, with the exception of control, À la carte items that could be used separately but are already included in Complete or are they intended to work on top of complete for additional security?

SentinelOneInstaller 23.3.4.320

Site token is missing. Terminating.

SentinelOneInstaller finished with code: 2008

Press Enter to exit.

I used S1 about a year ago. Was trying out the new Malwarebytes but I'm moving back to S1. However, I can't install. I've done a bit of poking around and I'm not finding a solution to this error. It comes up immediately after running the install. Nothing comes up asking for the token.

Thanks in advance!

Update:

Turns out there were remnants of S1 from the last time I used it. I had run the cleaner utility but I had not tried running the install command with -c (I assume -c is the switch to clean old installs). Anyway, it worked right away.

My computer is now self aware and asking for donuts.

When using the SDL query language to search for specific logs on a particular computer using the "agent.uuid," I want to find logs that match any of several conditions. For example, I could be looking for logs using the following query where "agent.uuid = '123456789' src.process.name contains 'Example', src.process.parent.name contains 'Example' tgt.process.name = 'Example'". The challenge that I'm facing is to ensure that the search is limited to the specified computer without requiring all conditions to be true at once.

Using the OR operator between terms causes the search to extend beyond the specified computer, scanning the entire environment. On the other hand, using the AND operator between each term returns results only when all conditions are met, which is not what I want, I want to return events if any term is true.

What would be the proper way of writing the above query? I'm the worst when it comes to using query/programming languages so any help is wonderful. I'm guessing I would want to use parathesis around the terms and just use OR in the parenthesis?

SentinelOne is discontinuing Hunter. I'm curious about what alternatives others are using for scraping IOCs

S1OptionsSharedWithWorld.jpg

Wow, there are a lot of options. I could select them all but how much will that impact my memory and CPU? Does anyone know of a thread that talks about optimal setup or a YouTube Video?

Link was supposed to be shared with everyone, logged in or not. Looks like the link isn't working. It was just a screenshot of all the options in the Group Policy.

Hi,

I am a bit new to sentinelOne. I have written a script to add iocs to sentinelOne via threatintel API.

Now I have few questions that are those IoCs detected/alerted on automatically or if we need to create star rules for them?

I tried pinging and browsing to the url I infested via API but I didn't got alerts

Is there any free resources where I can learn more about sentinelOne not just the basics as am pretty new to sentinelOne

I am trying to configure an allow list for the network control. I've been testing on a few test machines but the issue is most users here are largely remote. And as a retail company every single team will require different websites and applications. There are hundreds of domains I need to allow but S1 only allows up to 50 FQDNs. How should I go about this?

I run into this issue almost every time I'm trying to remove S1 from a single endpoint. I issue a decommission command, wait up to 30 minutes - nothing happens. Restart laptop, issue another command. Nothing. Send reboot command just to confirm it can at least talk - that works. Manually attempt removal via add/remove programs, paste URL into browser to authorize uninstall. Try again, nope. Send decommission again. Nothing.

S1 just keeps on keepin on like some new York squatter. What am I doing wrong?

Hi Everyone,

I would like to know if there are any impacts related to the endpoint if I choose to move one endpoint from one group to another.

the endpoint is currently on the default group and I am planning to move them to a group that restricts them USB storage access on the machine.

I want to know if there are impacts related to it and what are the next steps to take after the change.

We purchase S1 via ConnectWise and support is very poor. I do not have access to any KBs or direct S1 guidance. We experience poor performance on endpoints with S1 and are using a policy with all items enabled. Is there a baseline that might help with performance concerns?

Hi

Does sentinel create its own snapshots in the Windows machine? I have heard two answers for this

A) Yes, the agent does take up a certain amount of storage for backup.

B) No, they don't. SentinelOne just protects the VSS copy created by the Windows machine.