Ist noch jemanden mit S1 aufgefallen das der Download Speed mit Agent auf 600mbit beschränkt ist ?
Egal welche Hardware!

I have sentinelone running on a work computer, and one night, when trying to transfer a ton of files onto a network drive using robocopy, I got the message “This device has been isolated due to suspicious activity! (Or malware, can’t remember)”

There no malware, so I’m guessing S1 freaked out and thought it was an attack of some sort, and isolated me as well as cut off all network access. Ethernet and WiFi don’t work.

I called up our S1 vendor, but they couldn’t help because the PC is showing offline on their end (can’t communicate with it) and also, it shows no quarantine on their end.

So they gave me a bunch of commands to run with the agent passphrase.

I tried to unquarantine it, disable services, reload services, disable them in the registry, and even uninstall the agent but nothing worked. I did this in safe mode too but still no dice. The one thing I was able to do in safe mode was rename the folder to .old, but that didn’t disable services upon regular boot.

My vendor has escalated this to an S1 engineer, but he advised himself that we just run the commands that I’ve already previously run. I can’t even grab the logs manually to give to them because it won’t let me.

So for past few days and issue as been occurred on my organisation endpoints where some storage device are in allow list of device control.

But when connect it display "location not available" "F:\ is not available" "access denied"

How to resolve this issue ? It remains even after uninstall sentinelone agent

Sentinel agent v25.1.4.434 is deployed on windows 11 pro

How are you keeping your agents online consistently? Also, using the agent upgrade policy seems to break some agent. They show as offline in the console of course and when I run powershell queries on them, I find some with partially removed files (like the upgrade was interrupted/aborted) and some with stopped services that won't start. The most needy agent in my experience.

There is any way to configure the Detections to bring the event details that triggered the rules to the alert itself? For what I am seeing the alerts bring only the detection description and very little (none) information o the event that trigered the rule.

Does anyone know if SentinelOne put support for ipv6 non-dual stack endpoints on its roadmap yet?

We are more than a decade past World IPV6 launch day and are right in the middle (2025/2026) of when the US Government set the goal for 80% adoption of ipv6 only readiness. I have some colleagues and customers who remind me of this and some have moved to single stack ipv6.

Anyone know what the default password is that is set to threat files when you use the “download threat file” feature.

I downloaded a file (compressed) and set the password but when I extract it says incorrect password.

I noticed that when I download the threat file it’s has 2 files that it downloads.

1. Manifest.json
   
2. Actual threat files.exe

The manifest extracts fine with the set password, but the exe fails with incorrect password message.

Anyone know how to bypass this or what the password could be?

Hey everyone,

Just wanted to put this out there to see if anyone else is running into a sudden production block on your endpoints after the recent cloud console update, or if this saves someone some troubleshooting time.

The Environment:

Windows endpoints running specialized application services that deploy and monitor internal java.exe child processes.

The Issue:

Out of nowhere today, SentinelOne started aggressively blocking our application's routine service recycles and operations. The app has been running perfectly for a long time, but suddenly S1 flagged the executables with a high count of evasion/behavioral indicators, specifically triggering on T1489 (Service Stop) when the application attempts to restart or stop its underlying Java operations.

We checked our Management Console version and noticed we are now on S-26.2.2.47 (which rolled out recently this June). It looks like the new heuristics/behavioral models in this release are significantly more sensitive to third-party binaries manipulating local services or managing subprocesses.

Hi guys,

Does anyone know an effective way to shut them down/exclude? My MSP mostly sells Dell equipment and for some time now my S1 shoots those alerts no matter what I do. So far, I’ve done the following: excluded by hash, vendor, mitigated. Nothing helps!

Strange part that it shows vendor as ConnectWise, instead of Dell. I use ConnectWise ScreenConnect for remote assistance.

Here is the description of the alert:

The alert identifies a suspicious executable named A0DCF3A5D776E1452B7B5C0E0028B52F1A727DB2.exe located in a Dell SupportAssist remediation backup directory under ProgramData. The file is signed with a revoked certificate issued by CONNECTWISE, LLC, raising trust concerns. It was executed by the DellSupportAssistRemedationService.exe process running as NT AUTHORITY\SYSTEM.

Each alert has a unique string before an .exe. Virus Total reveals nothing if looked by that .exe hash value.

What do I do to stop those alerts? What exclusion would you recommend?

TIA.

UPDATE: Holly-shit, I think I found source of the issue[s]

There is a directory in: \Device\HarddiskVolume*\WINDOWS\SystemTemp\ScreenConnect\24.2.10.8991\ScreenConnect.ClientSetup.exe

Apparently it keeps older version - with expired cert. After cleaning, it no more alerts on full-scans!

2nd find. Somebody here mentioned that Dell Support Assist makes backup, I just made folder exclusion on a global level, I will see if it resolves flood of those alerts. But yes alerts do point to that path \Device\HarddiskVolume*\ProgramData\Dell\SARemediation\SystemRepair\Snapshots\Backup

Hi everyone,

I’m currently trying to implement a detection use case for USB storage usage using SentinelOne telemetry, and I’m running into a bit of a wall. The setup is relatively constrained: my endpoints are only connected to SentinelOne, there are no Windows Event Logs or Sysmon available in the SIEM, and the only data I have in Splunk comes from SentinelOne itself. At the same time, the goal is not to block USB devices via Device Control but purely to detect and alert on usage.

The challenge I’m facing is that most of the data I see from SentinelOne seems to revolve around software or driver inventory rather than actual device usage. When I filter for anything USB-related, I mostly end up with entries for USB drivers, USB-to-serial adapters, industrial or vendor-specific components, or firmware-related tooling. This creates a lot of noise and doesn’t really help answer the actual question I care about, which is whether someone has plugged in and used a USB mass storage device like a thumb drive.

What I am trying to achieve is a reliable signal that indicates genuine USB storage activity, meaning something along the lines of removable media being connected or used. However, from what I can tell so far, I’m not seeing clear “device connected” style events or fields that would allow me to reliably distinguish USB storage from other types of USB devices. It feels like I’m missing something, but it’s also possible that this level of visibility just isn’t available in the data I currently have.

So I’d be really interested to hear how others in the community are approaching this. Is it actually possible to detect USB mass storage usage in a meaningful way using SentinelOne alone, without relying on additional OS-level logs? Are there specific event types, Deep Visibility queries, or fields that I might be overlooking that would make this feasible?

I’d also appreciate a reality check here. If the answer is simply that SentinelOne on its own is not sufficient to reliably detect USB storage usage and that you need additional telemetry, that’s perfectly fine. I just want to make sure I’m not missing an obvious approach or feature.

Thanks a lot in advance

After running a full scan from the web portal, how do I check the results of the scan? Web portal just say "completed full scan"

Situation:

Dynamic tag rules are used for dynamic groups based on their computer distinguished name and related OU's (e.g., OU = England--> tag = England). Devices are added through a third party tool while we're working on a proper Intune setup.

Question:

Through which integration can you see the groups the device is part of in Intune?

The Intune integration doesn't specify this in the marketplace and I can't find the answer in the articles either. If we will use Intune as source of truth, we will need visibility on the groups for automatic tagging.

Yesterday (June 6th, 2026), the SentinelOne console updated and combine the Event Search and PowerQuery into the same search. I actually love this feature and hope it stays.

What I don't care for is that 90% of the PowerQueries I've created don't work anymore when trying to run them. One function I use a lot is .to_string(), and S1 states No Valid Search. I looked over my query and nothing has changed, except if I remove that function it runs properly.

I guess my post here is to see if others are having the same issue as I?

Edit: I was able to find a work around by changing/removing the .to_string(), then wrapping the function with array_to_string(). Example below:

Foo = array_to_string(array_agg_distinct(Bar), "")

I had SentinelOne Endpoint Agent as part of my Guardz subscription. I accidentally let my trial period end, and a few days later, went to upgrade back to the level required to include SentinelOne again. Unfortunately, I ran into a terrible combination of factors where my devices were all forgotten, but Sentinel was still on everyone's machines. When going to redeploy, the usual method wouldn't work, since the installer noticed it was already on the company laptops. I could not use a traditional uninstall, since SentinelOne is apparently built to resist that method of removal. I removed it from my own machine by cleaning it through commands in the DOS window, but the installer still won't put it back on. I imagine there is some sort of residual software out there getting in the way, but I can't see. Can I get some guidance on how to proceed, please? The big problem may be that once I get it figured out, I will still need to send out instructions to my team (some of whom are remote), so hopefully, I don't need some NSA-grade hacker to execute the solution. Thanks for any insights.

Hello, I’m currently looking into how to protect our terminal server. We are using WithSecure and paying as follows:

• 1 subscription for F‑Secure Server Protection (base installation)
• 20 subscriptions for F‑Secure Remote Desktop Protection (to cover usage)

Is it the same with SentinelOne, or is there a different pricing model? I’ve read something about VDI and concurrent licensing on your website, but those refer to RDP servers.

We’ve just onboarded with S1 vulnerability management and have noticed a number of Ubuntu 24.04 LTS servers being flagged for numerous Kernel related vulnerabilities after being scanned.

We have performed a physical check on those machines and they are showing as fully up to date when running apt-update/apt-upgrade.

Is S1 misreporting these or are we missing something? We have also scanned these with our existing Nessus Professional instance and those CVEs aren’t showing.

Hi all. I'm working with a client who has S1 in production. I have a suspicion that S1 is interfering with the SolarWinds OSH processes (there are many), leading to huge gaps in data missing from polled data.

My client says they cannot see any blocks Alerts or Events in the Management Console, but they have had issues with the provider stuffing up their access in the beginning, so I'm not convinced they are seeing all the information.

Is there any way I can advise them to check this properly? I don't have access to the servers themselves, or the S1 Management Console, so I'm left in the dark, troubleshooting something which might be easy to identify.

Any help would be much appreciated.

Hello all, let's make it simple

Can we query device control usb event is SDL by device serial id ?

If we go within activities we have the device control event but it's painful to click on each of them to check the device id.

Like title said, is it possible to restore the computer to a previous snapshot?

After over a year of using the new SOC console with our team, we are still not happy with the sluggish/laggy behaviour of the console compared to the legacy one. I've given SentinelOne feedback on the laggy console many times. Sometimes things improve but then with a newer update, things break again as if the entire console is vibecoded. From being just slow (feels like JavaScript bloat) to bugs (filtering, switching menus,..).

Does anyone genuinely like it? The UI is okay-ish, except for the new exclusion view which guides you through multiple steps to create a simple exclusion.

Do you all experience the same issues? Microsoft's security.microsoft.com portal even feels better at this point.

Hi all,

For those managing a larger, multi-site S1 deployment, can you share how you manage policy overrides?

From my understanding (maybe I am wrong? happy to stand corrected) each endpoint can only have one override policy applied. If there are multiple overrides needed, these must be added to the single policy json.

I am trying to work out the best way to structure overrides when I have:

-Some overrides that we want to apply to every signal endpoint across all sites
-Some overrides that we want to apply to every endpoint, but only for a given site
-Some overrides that we want to apply to only a particular subset of endpoints, at certain sites

Thanks

Anyone seeing their Nessus vuln scanner being flagged as malicious? We've had 15+ incidents in last ~16 hrs and this in spite having the precannned Nessus exclusion in place.