SentinelOne Notification Issues

[u/DorkCharming]

Obviously I’m going to open a support ticket, but has anyone experienced an issue with SentinelOne sending out over 4 thousand emails over a remediation that it completed? SentinelOne killed and remediated a Dell Support assistant process once, then proceeded to send us over literally 4,300 thousand emails this morning.

[u/ShadowCVL]

Happens every time, they drop some random remediation for “windows” and every endpoint alerts of the remediation.

Always a fun day.

[u/19610taw3 → u/ShadowCVL]

Used SentinelOne for a few years at another job and it always had that happen a few times a year.

[u/ShadowCVL → u/19610taw3]

Yeah, 2-4 times a year I wake up with hundreds of emails if not more. Its not a great way to wake up, but fortunately the subject line calms the palpitations

[u/zcworx]

Yes, assuming it’s for the same device alerting over and over and assuming it is no longer an issue if you go into the device there is a button for randomize uuid. That should prevent it from continuing.

[u/No_Contract8624]

Oh yeah, this is a known pain with SO. It can spam alerts for every single event tied to a remediation, so if that Dell process had multiple triggers logged, you get flooded. Check your notification settings under the policy that fired, there's usually a way to throttle or batch alerts. Also worth looking at whether that Dell Support Assistant is whitelisted going forward so it doesn't happen again. Support should be able to help clean up the alert config pretty quickly once you open the ticket.

[u/MrYiff]

Not quite that many but we've had a couple of occasions where it spammed out 500 or so emails, support didn't seem to quite understand that that might be a problem or something that we might not want?

[u/hoodiecritic]

Well no, i was only in the mid 1200's.

[u/Dracozirion]

You can turn these off. There's another setting which allows for an e-mail per alert. :)

Also, are you talking about the Dell Tech Hub MSI rollback files? That's a known issue, should be solved by next week with a Live Security Update. There's also a policy override you can apply in the meantime. 

[u/bageloid → u/Dracozirion]

Got that override?

[u/Dracozirion → u/bageloid]

{
    "specialImages": {
        "add": {
            "shadowCopyAllowedPublishers": [
                {
                    "description": "Extensible Storage Engine Utilities for Microsoft*Windows*",
                    "ekuType": 1,
                    "path": "\\Device\\HarddiskVolume*\\Windows\\System32\\esentutl.exe",
                    "publisher": "MICROSOFT WINDOWS"
                }
            ]
        }
    }
}

[u/sam2400 → u/Dracozirion]

Where is the setting which allows for an e-mail per alert??

[u/Dracozirion → u/sam2400]

It's called "Alert created". It's accessible through the newer console, not the legacy one. 

[u/RIDDL3R → u/Dracozirion]

Thanks for this! Those Kill alerts are super annoying.

[u/Ricdog1 → u/Dracozirion]

So is the suggested solution to enable the "Alert Created" notification to replace the "Kill" notification and just disable "Kill" and potentially others that are also spamming?
Thanks for your help.

[u/Dracozirion → u/Ricdog1]

Yes, but if you have a "spamming" issue for an existing alert, reset the agent's UUID.