SentinelOne Protection

The SentinelOne Protection check runs on the device and queries the local SentinelOne agent through sentinelctl. It reports whether the agent is running, whether real-time protection is active, whether the agent is connected to the SentinelOne management console, and whether the agent reports a threat it has not mitigated. It runs on Windows, Linux, and macOS (each as an x64 and an Arm64 build) every 5 minutes by default. octoja does not need a connection to the SentinelOne console for this. The check therefore reports only what the local agent itself knows; triage done in the SentinelOne console (Analyst Verdict, Incident Status) is not visible here.

Steps

1. Open the device under Devices and switch to the Checks tab.
2. Click Add Check → SentinelOne Protection.
3. Adjust the settings if needed.
4. Click Add Check.

To roll the check out to many devices at once, add it to a config package — see Assign checks with config packages.

Settings

Advanced options (visible after enabling Show advanced options)

Results

The check reports the worst status of all problems it finds.

If the agent is not running or is disabled, the check reports only that root cause and does not additionally evaluate real-time protection and console connectivity. A reported threat is always included.

Differences by platform

The check looks for sentinelctl below C:\Program Files\SentinelOne on Windows, in /usr/local/bin/sentinelctl or the bundle under /Library/Sentinel/sentinel-agent.bundle on macOS, and in /opt/sentinelone/bin/sentinelctl on Linux.

See also: Set up alerts for a check