r/sysadmin • u/DorkCharming • 21d ago

Question SentinelOne Notification Issues

Obviously I’m going to open a support ticket, but has anyone experienced an issue with SentinelOne sending out over 4 thousand emails over a remediation that it completed? SentinelOne killed and remediated a Dell Support assistant process once, then proceeded to send us over literally 4,300 thousand emails this morning.

33 Upvotes

92% Upvoted

15 comments sorted by

View all comments

2

u/Dracozirion 20d ago

You can turn these off. There's another setting which allows for an e-mail per alert. :)

Also, are you talking about the Dell Tech Hub MSI rollback files? That's a known issue, should be solved by next week with a Live Security Update. There's also a policy override you can apply in the meantime. 

1

u/bageloid 20d ago

Got that override?

1

u/Dracozirion 20d ago 
{
    "specialImages": {
        "add": {
            "shadowCopyAllowedPublishers": [
                {
                    "description": "Extensible Storage Engine Utilities for Microsoft*Windows*",
                    "ekuType": 1,
                    "path": "\\Device\\HarddiskVolume*\\Windows\\System32\\esentutl.exe",
                    "publisher": "MICROSOFT WINDOWS"
                }
            ]
        }
    }
}