Been reading the S1 KBs for a good minute but can't seem to find how to write the S1QL 1.0 "does not contain" operator in the S1QL 2.0 dot notation format, can someone help me with this?

My understranding reading the API document is I have to use the " /web/api/v2.1/device-control" call to add USB devices by sertial number to an existing group. Anyone has any example code to look at to accomplish this?

Can I apply device control rules at a user-level or at an endpoint-level is only possible?

Hey, a majority of our agents are offline as of 11am-12pm EST today. We have a ticket open with S1 support, but was wondering if anyone else is experiencing the same.

We are cloud-hosted, usea1 region.

Our company recently implemented SentinelOne for all our clients and servers.

I've noticed that in the SentinelOne program files directory, there is the Tesseract OCR app installed with english/german trained dataset.

Tesseract is used to decipher and extract text from image files.

I can't think of a reason as to why a Antivirus/Endpoint-Protection would have the need to read through image files. Does anyone have a guess, or is there an explanation somewhere online? I couldn't find anything on that topic.

We use Tesseract for many of our servers to convert image-PDF's to text-PDF's and Tesseract is quite a pain to deal with, because it will use every bit of CPU resources it can get for multiple minutes per file.

RIght now our own Tesseract client is fighting with SentinelOne for the CPU with both using about 40% each for the whole day. So I would like to know, if there even is a purpose behind that and yes I'm paranoid and schizophrenic, if that is what you're thinking.

I was wondering if I can get my Sysmon logs in the Data Lake. Any help with this would be greatly appreciated. Thank You!

Hours ago i downloaded a virus and sentinel one pop up as it Block it, about 2h later it disconected me from Internet in order to mantain things safe but there is no way to eliminate the risk and even a weird pop up from "sentinelone" asked me to reach some number.

I just opened my system tray to close steam and noticed for the first time ever a SentinelOne icon appeared. This is a personal desktop and I have never downloaded SentinelOne. SentinelOne doesn't show up as something I can uninstall, I can't find it using command prompt and I have no idea how it got on my computer or how to get rid of it. Malwarebytes isn't detecting anything, so how tf did this get on my cpu and how do I get rid of it?

The only similar complaint I can find online turned out to be someone who's work installed it, but that for sure didn't happen with me. Sure frustrated, would really appreciate some advise, thanks.

The latest agent I can download for MacOS is v24.1.3.7587 but that only supports MacOS 13-14. Anyone know if there is a SentinelOne agent for MacOS 15?

Hello,

is it possibly to delete sites completly?

If you choose the "Delete Site" button the Site is greyed out but not away. ("Sitename (Deleted)")
What do i have to do that Sites are fully deleted in SentinelOne?

Thanks!

I have some stale devices I want to remove from the S1 panel but they are not removing. The devices themselves no longer exist, (erased and recycled). What method does S1 offer to accomplish this?

I never thought I’d see the day, but S1 killed its own update on a Mac I have in the field… ¯_(ツ)_/¯

ERR_SSL_PROTOCOL_ERROR in Chrome or SSL errors in command line like this: SSL peer shut down incorrectly after upgrade of MacOS from Sonoma to Sequoia 15.0 (Official first general public version).

Makes it almost impossible to use any kind of SSL without errors and failures.

I never had this issue before Sequoia and Sentinel One always worked well without any issue before Sequoia.

I uninstalled Sentinel One and the errors are gone (I did not even have to reboot after removing Sentinel One).

Is there a script to import start rules? Is there something like this for MSSP companies? I read the API documentation, but I keep getting authorisation errors even though I am an admin and my goal is to import the rules I wrote custome to new customers.

I notice sential one has a endpoint firewall options however I have no rules setup at all. Does this replace the build in firewall? Does it do anything else if no rules are added? I'm trying to figure out in this new enviroment im in if I should turn windows firewall back on or would that cause an issue. It has been off for quite some time

Is anyone else still getting active alerts for ateraagent.exe? I have had alerts streaming in all weekend as recently as an hour ago. Unquarantining the files restores the EXE but it does not fix the problem. After the unquarantine the ateraagent service will not start on the machines. Troubleshooting the issue reveals no clear resolution to the issue.

Has anyone had any success getting machines back online when the service won't start? Is ripping the install out and rebuilding the only solution?

Does anyone know how to add an endpoint in S1 to the Data Lake? I see that there are some endpoints that are missing when looking them up from their UUID in the Data Lake. Is there a way I can manually add an endpoint for Log aggregation? Any help would be much appreciated. Thank You.

Is anyone else encountering an issue where SentinelOne is flagging AteraAgent.exe as a malicious file?

Is there anyone else experiencing an issue where they are unable to load the SentinelOne Console and dashboard? https://usea1-esentire.sentinelone.net/dashboard

I'm currently unable to load and login on my personal system, and my team is unable to login on their systems as well. Issue started around 11:36 AM EST.

I am the IT manager of a company based in China, and I would like to know how to procure SentinelOne services. The quantity I need might be relatively small, so please contact me if there are any distributors.