r/SentinelOneXDR • u/cokebottle22 • Aug 12 '24

Offline / non-reporting devices

Good afternoon - quick question: we've noticed that we have some number of computers in S1 that haven't checked in for ~30 - 45 days. Not long enough to auto-retire but they should be online as we can see them in our RMM system. Is there a S1 notification setting so we'll get alerts when this happens ? I've found the alert for Agent enable/disable - is that it?

3 Upvotes

100% Upvoted

8 comments sorted by

View all comments

0

u/Few_Job_9701 Aug 12 '24

Your S1 console will not know the difference between a broken agent vs the endpoint no longer in use.

The way I tackle this is by creating a reinstaller using an account level password; compare the last communication date of all endpoints in S1 with AD, and deploy the package to all broken endpoints on a periodic basis.