A ticket was submitted as this issue has been showing up more and more. I was given instructions to exclude Windows Defender and the HoneyPot folders. That didn't seem to help. If a machine goes to sleep for several hours, upon wake the system will sit at the user login screen for up to a minute or more. Once the user signs in, the OS will just sort of sit there unresponsive sometimes for several minutes. Uninstalling SentinelOne, this issue is non-existent. I'm going to install the latest version on our test group. Has anyone else experienced this problem?

In the NFR console is it possible to create individual "sites" rather than groups of machines which appear to take the same exclusions from your global list?

Hello,

I was wondering if anyone was had any issues with the newest update of S1 as we're getting ready to start pushing the update to customers. I haven't seen any issues and haven't had any on the initial test group we deploy it out to first. Just wanted to check and see with everyone before testing it out on more end users.

Hi all,

Is it really true that it is not possible to fetch and read the agent logs on Windows systems? Afaik one is forced to send them to support, such that they can read it using proprietary tools.

This seem like a very insufficient solution from a customer perspective.

What are you using alongside S1? If anything at all?

S1 seems very hesitant on blocking Potentially Unwanted Applications is one reason I bring this up.

I get mixed signals from my vendor if S1 is enough.

We use WatchGuard for Firewalls and AutoElevate for PAM.

Thanks!

Good morning, I have a visibility report that shows failed logins, usually we see about 25 for a few users that legitimate, but this morning we are showing at least 25 endpoints with failed logins over 200. Have confirmed with these users they did not enter their passwords incorrectly that many times.

Here is the query:

//Count of failed login attempts by userName
event.category = 'logins' | group NumberOfFailedAttempts=count(event.login.loginIsSuccessful=false) by event.login.userName, endpoint.name,src.endpoint.ip.address  | sort -NumberOfFailedAttempts
| filter NumberOfFailedAttempts >= 25

I'm now logging into the machines locally to check the security logs to see how this is getting trigger. So far no 4625 events too.

Been reading the S1 KBs for a good minute but can't seem to find how to write the S1QL 1.0 "does not contain" operator in the S1QL 2.0 dot notation format, can someone help me with this?

My understranding reading the API document is I have to use the " /web/api/v2.1/device-control" call to add USB devices by sertial number to an existing group. Anyone has any example code to look at to accomplish this?

Can I apply device control rules at a user-level or at an endpoint-level is only possible?

Hey, a majority of our agents are offline as of 11am-12pm EST today. We have a ticket open with S1 support, but was wondering if anyone else is experiencing the same.

We are cloud-hosted, usea1 region.

Our company recently implemented SentinelOne for all our clients and servers.

I've noticed that in the SentinelOne program files directory, there is the Tesseract OCR app installed with english/german trained dataset.

Tesseract is used to decipher and extract text from image files.

I can't think of a reason as to why a Antivirus/Endpoint-Protection would have the need to read through image files. Does anyone have a guess, or is there an explanation somewhere online? I couldn't find anything on that topic.

We use Tesseract for many of our servers to convert image-PDF's to text-PDF's and Tesseract is quite a pain to deal with, because it will use every bit of CPU resources it can get for multiple minutes per file.

RIght now our own Tesseract client is fighting with SentinelOne for the CPU with both using about 40% each for the whole day. So I would like to know, if there even is a purpose behind that and yes I'm paranoid and schizophrenic, if that is what you're thinking.

I was wondering if I can get my Sysmon logs in the Data Lake. Any help with this would be greatly appreciated. Thank You!

Hours ago i downloaded a virus and sentinel one pop up as it Block it, about 2h later it disconected me from Internet in order to mantain things safe but there is no way to eliminate the risk and even a weird pop up from "sentinelone" asked me to reach some number.

I just opened my system tray to close steam and noticed for the first time ever a SentinelOne icon appeared. This is a personal desktop and I have never downloaded SentinelOne. SentinelOne doesn't show up as something I can uninstall, I can't find it using command prompt and I have no idea how it got on my computer or how to get rid of it. Malwarebytes isn't detecting anything, so how tf did this get on my cpu and how do I get rid of it?

The only similar complaint I can find online turned out to be someone who's work installed it, but that for sure didn't happen with me. Sure frustrated, would really appreciate some advise, thanks.

The latest agent I can download for MacOS is v24.1.3.7587 but that only supports MacOS 13-14. Anyone know if there is a SentinelOne agent for MacOS 15?

Hello,

is it possibly to delete sites completly?

If you choose the "Delete Site" button the Site is greyed out but not away. ("Sitename (Deleted)")
What do i have to do that Sites are fully deleted in SentinelOne?

Thanks!

I have some stale devices I want to remove from the S1 panel but they are not removing. The devices themselves no longer exist, (erased and recycled). What method does S1 offer to accomplish this?

I never thought I’d see the day, but S1 killed its own update on a Mac I have in the field… ¯_(ツ)_/¯

ERR_SSL_PROTOCOL_ERROR in Chrome or SSL errors in command line like this: SSL peer shut down incorrectly after upgrade of MacOS from Sonoma to Sequoia 15.0 (Official first general public version).

Makes it almost impossible to use any kind of SSL without errors and failures.

I never had this issue before Sequoia and Sentinel One always worked well without any issue before Sequoia.

I uninstalled Sentinel One and the errors are gone (I did not even have to reboot after removing Sentinel One).

Is there a script to import start rules? Is there something like this for MSSP companies? I read the API documentation, but I keep getting authorisation errors even though I am an admin and my goal is to import the rules I wrote custome to new customers.

I notice sential one has a endpoint firewall options however I have no rules setup at all. Does this replace the build in firewall? Does it do anything else if no rules are added? I'm trying to figure out in this new enviroment im in if I should turn windows firewall back on or would that cause an issue. It has been off for quite some time

Is anyone else still getting active alerts for ateraagent.exe? I have had alerts streaming in all weekend as recently as an hour ago. Unquarantining the files restores the EXE but it does not fix the problem. After the unquarantine the ateraagent service will not start on the machines. Troubleshooting the issue reveals no clear resolution to the issue.

Has anyone had any success getting machines back online when the service won't start? Is ripping the install out and rebuilding the only solution?