Helpdesk

When set to Detect: Sends Not Mitigated Threat alerts when it detects a malicious threat. Does not automatically mitigate.

When set to Detect: The Agent sends Not Mitigated Threat alerts when it detects a suspicious threat. Does not automatically mitigate.

Defines the automatic mitigation of Office files that contain malicious VBA macros modules.

When disabled, places malicious macros from Office files in quarantine but does not remove them from the file itself.

When disabled, the Agent does not disconnect endpoints from the network if a threat is found after the threat is executed.

A threat intelligence engine that matches on-disk file hashes to different threat intelligence feeds and user-defined blocklists to make sure no known malicious files are written to disk or executed. You cannot disable this engine.

A Static AI engine that uses machine learning technologies and heuristics (through YARA rules) to scan for malicious files executed or written to disk. Malicious detections have a high confidence score generated by the Static AI engine.

A Static AI engine that uses machine learning technologies and heuristics (through YARA rules) to scan for suspicious files executed or written to disk. Suspicious detections have a moderate confidence score generated by the Static AI engine.

A Behavioral AI engine that uses machine learning techniques to detect process chains associated with malicious activities. This engine detects malicious activities in real-time, when processes execute.

A Behavioral AI engine that uses machine learning techniques to detect malicious documents and scripts.

A Behavioral AI engine that detects attacks initiated by remote devices. Attackers find a host on a network and use it to compromise other devices on the same network.

A Behavioral AI engine that is focused on memory exploits and fileless attack techniques, such as web-related and command line exploits.

A Static AI engine for macOS devices that inspects applications that are usually unsuitable for business networks and can potentially be used for malicious operations.

When enabled, the engine makes sure that only executables from the original container image run in the container. This maintains the immutability of the containerized workloads. This supports both K8s clusters and other containerized workloads.

When enabled, this Behavioral AI engine detects malicious activity in interactive sessions (for example, an authenticated user runs malicious actions from a CMD or PowerShell command line). When enabled, this engine detects malicious commands entered in a CLI, and so it is likely to generate false positives for endpoints with active legitimate CLI users.

When enabled, the Agent keeps VSS snapshots for rollback. If disabled, rollback is not available.  

When enabled, the Agent does not let end users, or malware, change, uninstall, or disable the Agent.

When enabled, Agents run a Full Disk Scan when they first connect to the Management. Full Disk Scan finds dormant suspicious activity, threats, and compliance violations, that are then mitigated according to the Malicious Threat and Suspicious Threat settings of the policy.

When enabled, a preemptive engine prevents Windows suspicious kernel drivers from loading. These driver types are blocked:

In addition, we recommend you also enable the blocking of all suspicious Windows drivers that are signed and unsigned.

When enabled, the Agent saves logs for troubleshooting and Support.

When enabled, end-users must get authorization before they are allowed to locally upgrade (or downgrade) Agents.

Deep Visibility is enabled or disabled for this scope. When enabled, Agents send Deep Visibility data to the Management.

When enabled, Agents collect created and changed processes.

When enabled, Agents collect created, changed, or deleted files.

When enabled, Agents collect visited sites. Requires the SentinelOne browser extension for most browsers.

When enabled, Agents collect DNS connection data.

When enabled, Agents collect incoming and outgoing connection data.

When enabled, Agents collect login related events.

When enabled, Agents collect events that add, edit, or remove registry keys.

When enabled, Agents collect scheduled task data.

When enabled, Agents collect and organize data on suspicious behavior and techniques.

When enabled, Agents collect PowerShell and other command-line scripts.

When enabled, Agents collect events between processes.

When enabled, Agents collect created named pipes and remote collections.

When enabled, Agents collect events that load drivers.

When enabled, Agents mask paths of ZIP, PDF, and Office documents.

When enabled, Agents focus file collection on binaries and files suspected to contain active content. This can significantly improve network bandwidth consumption.

Important: Do not select if your organization uses Google Workspace (formerly G Suite) to manage browser extensions.

When installed, this overrides other browser extensions deployed with Google Workspace. If your organization uses Google Workspace to deploy browser extensions, deselect this option and deploy the SentinelOne browser extension in the same way you deploy other extensions.

Applies only to endpoints with Windows Agents 4.7 and higher.