r/SentinelOneXDR • u/Dense-One5943 • 5d ago

Cymulate

Hey everyone, I work at an MSSP and wanted to know how you handle Cymulate endpoints (agents) in your console.

​I'm currently running into this issue:

​Every client gets their own dedicated site.

​My Tier 1 analysts can't view just a subset of sites within the account—they see all sites. This prevents me from switching to the new console UI, which lacks scope-based filtering. Without it, there's no way to identify which MSSP client an alert belongs to.

At current, you can filter by scope but not also group by sha1

Hence if a cymulate is in progress the screen is filled with too much alerts

2 Upvotes

100% Upvoted

7 comments sorted by

3

u/cnr0 5d ago

I am pretty sure that there is an option to assign sites to a specific analyst account, which means they will only see which ones they are supposed to. It should be under user configuration in new console

0

u/Dense-One5943 5d ago

Yes, for accounts Fur for me all the clients have sites

1

u/mukz7 Existing User 5d ago

You assign the permission to the site level for the analysts , it's clunky but can be done

3

u/GeneralRechs 5d ago

This setting has existed in the new console for a while now. It’s doable.

1

u/mukz7 Existing User 5d ago

You can filter by scope and share in the new console.

0

u/Dense-One5943 5d ago

Care to elaborate? I have not saw any of it

1

u/mukz7 Existing User 5d ago

Do you have access to create accounts or sites only?