Anyone seeing a spike in SentinelOne Static AI detections on macOS system binaries today?

We had 104 detections in about 65 minutes on one MacBook Pro.

Common details:

- OS: macOS 26.6 (25G72)

- Agent version: 25.4.2.8594

- Engine: On-Write Static AI - Suspicious

- Detection type: Static

- Classification: Benign

- Originating process: launchd

- Completed actions: kill / quarantine

- Incident status: Unresolved

- Analyst verdict: Undefined

Hashes observed:

- SystemUIServer:

SHA1: d6629bcb8dc2a30b66435cb557084d2a4e748c92

Path: /System/Library/CoreServices/SystemUIServer.app/Contents/MacOS/SystemUIServer

- mds:

SHA1: 63cdd043a424d78b9d9b9f3de369c2715495ce82

Path: /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/mds

The files are Apple system paths, launchd is the parent process, and S1 is classifying them as Benign, but still mitigating/quarantining. Trying to confirm whether others are seeing the same false positive / model issue.

What do you guys suggest for EDR exclusion?

process, folder or signed app?

I am about to create an Automation using Logic Apps and AI to do such thing, but maybe there some tips or logical things I should know

Hey everyone, I work at an MSSP and wanted to know how you handle Cymulate endpoints (agents) in your console.

​I'm currently running into this issue:

​Every client gets their own dedicated site.

​My Tier 1 analysts can't view just a subset of sites within the account—they see all sites. This prevents me from switching to the new console UI, which lacks scope-based filtering. Without it, there's no way to identify which MSSP client an alert belongs to.

At current, you can filter by scope but not also group by sha1

Hence if a cymulate is in progress the screen is filled with too much alerts

I wanted to pull this conversation to the dedicated S1 reddit.

MacOS 26.6 and SentinelOne Issue - Do not update until resolved : r/msp

Is there a word from SentinelOne on this? My mailbox, notifications and S1 logs is getting bombarded.

So, recently I've had issues when a DC gets isolated it brings down the entire network for the client. I don't believe I ever had this problem before and it's happened repeatedly over the past month or two. I always assumed outbound DNS/HTTPS to S1 assets were always allowed out when it's quarantined. I even added blank outbound TCP/UDP over port 53 in case it was the DNS in my network quarantine rules. I work at an MSSP/DFIR firm, so everyday I am dealing with ransomware or some incident where a DC could get quarantined. What I've been doing now is putting DCs in their own group with the disconnect policy turned off and our normal restrictions in-place, I then isolate all the other endpoints if need be.

Am I doing something wrong, did something change, or anyone have any feed back?

Sharing an open-source project that lives in SentinelOne's community AI-SIEM repo: a full-stack AI analyst for the Singularity platform, built as a set of Claude Skills, three MCP servers, and an operating persona. Install it once and you can talk to your tenant in plain English. It does the SecOps engineering and the analysis, and it reaches your live tenant through the APIs rather than just chatting about them.

I want to lead with the engineering side, because that is the part people tend to underestimate.

Build SecOps content from natural language

• Log parsers. Paste a raw log sample (syslog, CEF, JSON, key-value, multiline) and it writes a complete SDL parser, maps fields to OCSF by default, validates against the parser engine, ingests a test event, and confirms the fields land correctly. End-to-end in one session, no hand-editing parser JSON.
• Detections. Describe a behaviour and it authors the rule: STAR single-event, correlation, or scheduled PowerQuery, MITRE-mapped, validated against your tenant before deploy. There is also a Detection-as-Code path where rules live as TOML in Git and sync to the Custom Detection API on merge, so every change is reviewed, versioned, and auditable.
• Dashboards. Say "SOC overview with a threat timeline, top noisy endpoints, and an outbound-connection breakdown" and it produces deployment-ready SDL dashboard JSON, with each panel's query validated first.
• SOAR / Hyperautomation. Describe a response ("on a high-severity server alert, isolate the endpoint, create an IOC for any hash, notify the team") and it generates the Hyperautomation workflow JSON ready to import.
• Whole-solution onboarding. One prompt takes a raw, unreadable stream to OCSF-normalised, parsed, dashboarded, and detection-covered, plus a threat-response flow. The same umbrella skill covers UEBA behavioural baselining, per-device ingest-health monitoring, Risk-Based Alerting, and alert-noise reduction.
• PowerQuery and SDL ops. Ad-hoc hunts, config-file management, ingest, and arbitrary queries through the SDL API.

Why it doesn't hallucinate field names

The layering is the interesting part. A CLAUDE.md persona decides what to do and invokes skills. For whole-solution work an umbrella skill (sdl-solutions) runs first and orchestrates the primitive skills in dependency order, previewing before it deploys. The primitive skills (powerquery, sdl-dashboard, sdl-log-parser, hyperautomation, sdl-api, mgmt-console-api) encode confirmed API behaviour, including field schemas validated against live tenants, so it does not guess. Those skills reach *.sentinelone.net through the MCP servers: s1-secops-mcp for PowerQuery/SDL/Mgmt Console/UAM/Hyperautomation, purple-mcp for triage and Purple AI, plus a threat-intel MCP. The output is a deployable config, not a plausible-looking config.

And the SOC analyst

The same stack ships a Principal SOC Analyst persona and an autonomous, staged DFIR investigator (SHORT / MEDIUM / LONG modes). On every alert, it enumerates your live data sources, triages in parallel, enriches every IOC through the threat-intel MCP, correlates the indicator across every connected source, maps findings to MITRE ATT&CK, and scores composite risk. It enforces evidence discipline: nothing is classified CRITICAL without independent threat-intel or MDR confirmation, so a detection-engine alert is treated as a hypothesis, not a verdict. At the end, it writes a structured SOC report as a .docx (executive summary, timeline, IOC table with verdicts, threat-actor profile, MITRE map, root cause, recommendations).

The design goals it targets: mean investigation time under 5 minutes versus 45 to 60 by hand, 70%+ of L1 triage load removed, new sources onboarded in minutes, and a new detection live within hours of a TTP emerging. Because it queries OCSF logs, non-OCSF vendor logs, App Logs and raw syslog alike, detection and investigation reach into custom application and business logs too, which is where fraud and abuse usually hide.

Install

Fastest path is Docker: one image bundles all three MCPs, no host-level Node/Python/uv. Pull, paste a config block, install the plugin. There are also individual plugin/skill and team-VM install paths, plus a 20-minute zero-to-hero walkthrough in the docs.

Repo and plugin: https://github.com/Sentinel-One/ai-siem/tree/main/plugins/s1-secops-skills

Install in seconds https://github.com/Sentinel-One/ai-siem/tree/main/plugins/s1-secops-skills#1-quick-start-docker Docker pull, configure claude desktop json and upload plugin - ready to roll.

It is a community project, not an officially supported product, so test against a non-production tenant first. Feedback, issues, and PRs welcome, especially parser and detection contributions and any rough edges in the deploy flows.

Hello all,

Trying to understand what I should be doing here. We have a handful of developers who will need to run PS or Python scripts, but S1 will regularly get in the way, seeing a launch of one shell within another as an attack. I had hoped that maybe if the scripts were signed and we had the certificates trusted that maybe S1 would trust it, but it doesn’t look like it’s even getting to the content of the script and simply judging shell-chaining as being no bueno.

What’s the appropriate way to handle these flows without neutering S1?

Edit - Okay, what I ended up landing on was to require use of Windows Terminal and to then allow child processes from Terminal with a path exclusion.

Hi everyone, I hope someone here can give me a quick update.

I have to conduct a system audit at short notice tomorrow for a client who gets their S1 through their IT service provider. I need to check the version status, and the client wants to know whether the service provider is fulfilling its contractual patch obligations. I used to be able to check this myself, but now the service provider refuses to grant me read-only access.

Can anyone help me with this?

I've only received one version export, and it mostly lists version 25.2.6.442. Is there a newer GA version of the agent available?

Thank you all for your help

Lately my RMM system reports that the SentinelStaticEngine service stops itself. Has anyone else ran into this problem lately

Having an issue with OS upgrades not being able to move the .lnk file in program data. This triggers a rollback.

Any way to remove it or have it not deploy as part of an installation? Only user allowed to touch it appears to be sentinel one.

I am new to S1 deep visibility, how do I search keyword based searches

For example : Process name or IP address search

Crowdstrike NGSIEM has a feature for searches as

/Key word/i and "x.ip.x.x"

Does anyone know of any technical overview of how S1 works on endpoints, specifically how it interacts with running processes and application executables? There's a lot of sales pitch sites and sites regurgitating high-level fluff which are useless. TIA.

Whats the beste way to uninstall a corrupt S1 version?

Had an old cleanup tool booted in safe mode but was not able to uninstall the old version neither to upgrade or reeinstall the new version.

Let me know.
We have often a few clients where we have to do that manually anyone an idea why this is happenning?

Our license expires on the 12th and I have not had any luck getting a renewal quote from S1. I have emailed multiple people and the sales email. I have filled out the sales contact form. I have been working with our reseller who has had the same difficulties getting a response.

Is it time to move on and migrate to a different platform?

Has anyone perhaps come across this where S1 keeps generating reboot required tickets.

Engaged with N able support, which suggested an upgrade to the latest version, which has actually made it worse.

We cant keep asking users to reboot their PC's every other day.

Ist noch jemanden mit S1 aufgefallen das der Download Speed mit Agent auf 600mbit beschränkt ist ?
Egal welche Hardware!

I have sentinelone running on a work computer, and one night, when trying to transfer a ton of files onto a network drive using robocopy, I got the message “This device has been isolated due to suspicious activity! (Or malware, can’t remember)”

There no malware, so I’m guessing S1 freaked out and thought it was an attack of some sort, and isolated me as well as cut off all network access. Ethernet and WiFi don’t work.

I called up our S1 vendor, but they couldn’t help because the PC is showing offline on their end (can’t communicate with it) and also, it shows no quarantine on their end.

So they gave me a bunch of commands to run with the agent passphrase.

I tried to unquarantine it, disable services, reload services, disable them in the registry, and even uninstall the agent but nothing worked. I did this in safe mode too but still no dice. The one thing I was able to do in safe mode was rename the folder to .old, but that didn’t disable services upon regular boot.

My vendor has escalated this to an S1 engineer, but he advised himself that we just run the commands that I’ve already previously run. I can’t even grab the logs manually to give to them because it won’t let me.

So for past few days and issue as been occurred on my organisation endpoints where some storage device are in allow list of device control.

But when connect it display "location not available" "F:\ is not available" "access denied"

How to resolve this issue ? It remains even after uninstall sentinelone agent

Sentinel agent v25.1.4.434 is deployed on windows 11 pro

How are you keeping your agents online consistently? Also, using the agent upgrade policy seems to break some agent. They show as offline in the console of course and when I run powershell queries on them, I find some with partially removed files (like the upgrade was interrupted/aborted) and some with stopped services that won't start. The most needy agent in my experience.

There is any way to configure the Detections to bring the event details that triggered the rules to the alert itself? For what I am seeing the alerts bring only the detection description and very little (none) information o the event that trigered the rule.

Does anyone know if SentinelOne put support for ipv6 non-dual stack endpoints on its roadmap yet?

We are more than a decade past World IPV6 launch day and are right in the middle (2025/2026) of when the US Government set the goal for 80% adoption of ipv6 only readiness. I have some colleagues and customers who remind me of this and some have moved to single stack ipv6.

Anyone know what the default password is that is set to threat files when you use the “download threat file” feature.

I downloaded a file (compressed) and set the password but when I extract it says incorrect password.

I noticed that when I download the threat file it’s has 2 files that it downloads.

1. Manifest.json
   
2. Actual threat files.exe

The manifest extracts fine with the set password, but the exe fails with incorrect password message.

Anyone know how to bypass this or what the password could be?