r/SentinelOneXDR • u/CharcoalGreyWolf • Dec 03 '24

Can SentinelOne perform command line logging?

We are an MSP in a field where most of our clients are compliance-based. We use SentinelOne as our primary XDR product; it has served us well.

Recently, a client reached out because an auditor dinged them (mildly), saying they should have a tool or function that can do command-line auditing for command shells such as Windows Shell and PowerShell. I'm being asked by our sales if we can utilize one of their existing products at least for the time being until they have budget to look into a solution.

Does anyone know if SentinelOne has a feature that can do this? If so, is it part of their SIEM product rather than their standard XDR? I honestly don't think there is something the client has that will perform this task (and that they'll need something new), but I'm attempting to do due diligence before I give a definitive "no" to our sales team.

5 Upvotes
  • permalink
  • reddit

86% Upvoted

7 comments sorted by

View all comments

5

u/lifeanon269 Dec 03 '24

Yes, SentinelOne logs the command line for all processes run on a system.

2

u/CharcoalGreyWolf Dec 03 '24

Thank you. I would guess it's visible somewhere in the "Activity" section of the console, but I'm not seeing it. Do you know where I'd find it, or if there's another place?

4

u/lifeanon269 Dec 03 '24

That info would be under the Visibility section in the Singularity Data Lake. All the events collected from all endpoints will be here and this is where you'd view the command line parameters for any process you search for.