SentinelOne

Event	Title	Channel	Sample	Rule
1	Windows Agent is starting in AgentMode mode.	Operational	N	N
2	Policy was changed in the Console: %1.	Operational	N	N
3	Policy was changed with override commands: %1.	Operational	N	N
4	Failed to register with management because it no longer exists.	Operational	N	N
5	Failed to register with management: Reason (ErrorCode).	Operational	N	N
6	Threat remediation: Failed to delete file FilePath because it was already …	Operational	N	N
7	Threat remediation: Failed to delete file FilePath.	Operational	N	N
8	Threat remediation: Failed to rename file SourceFilePath to DestinationFilePath …	Operational	N	N
9	Threat remediation: Failed to rename file SourceFilePath to DestinationFilePath …	Operational	N	N
10	Threat remediation: Failed to rename file SourceFilePath to DestinationFilePath …	Operational	N	N
11	Threat remediation: Failed to rename file SourceFilePath to DestinationFilePath.	Operational	N	N
12	Threat remediation: Failed to restore file FilePath to timestamp …	Operational	N	N
13	Threat remediation: Failed to restore file FilePath to timestamp …	Operational	N	N
14	Threat remediation: Failed to restore file FilePath to timestamp …	Operational	N	N
15	Threat remediation: Failed to restore registry value (key: RegistryKeyPath, …	Operational	N	N
16	Threat mitigation: Failed to kill malicious processes because the true context …	Operational	N	N
17	Threat mitigation completion after reboot requested another reboot.	Operational	N	N
18	Threat mitigation: Not killing process ProcessName (Path: ProcessPath, Process …	Operational	N	N
19	Threat mitigation: Cannot kill process ProcessName (Path: ProcessPath, Process …	Operational	N	N
20	Threat mitigation: Cannot kill process ProcessName (Path: ProcessPath, Process …	Operational	N	N
21	Threat mitigation: Cannot kill process ProcessName (Path: ProcessPath, Process …	Operational	N	N
22	Threat mitigation: Cannot kill threads of process ProcessName (Path: …	Operational	N	N
23	Threat mitigation: Failed to quarantine file FilePath because the file is …	Operational	N	N
24	Threat mitigation: Failed to quarantine file FilePath because the file belongs …	Operational	N	N
25	Threat mitigation: Failed to scramble file FilePath.	Operational	N	N
26	Threat mitigation: skipping quarantine of file FilePath because the file was …	Operational	N	N
27	Threat mitigation: Failed to quarantine file FilePath because the file does not …	Operational	N	N
28	Threat mitigation: A reboot is required to complete the quarantine of file …	Operational	N	N
29	Threat mitigation: Failed to quarantine a file.	Operational	N	N
30	Network quarantine failed.	Operational	N	N
31	Malware detected!	Operational	N	N
32	Mitigation report.	Operational	N	N
33	Failed to unquarantine file FilePath because the file cannot be found.	Operational	N	N
34	Unquarantine: Failed to restore file times for FilePath.	Operational	N	N
35	Failed to unquarantine files affected by threat of True Context ID …	Operational	N	N
36	Network unquarantine failed.	Operational	N	N
37	Policy not changed. Verification key not provided.	Operational	N	N
38	Policy not changed. The provided verification key is incorrect.	Operational	N	N
39	Policy not changed. A parameter cannot be both set and undefined.	Operational	N	N
40	Policy not changed. Parameter was not provided.	Operational	N	N
41	Policy not changed.	Operational	N	N
42	Policy not changed.	Operational	N	N
43	Policy not changed. The provided proxy credentials are invalid.	Operational	N	N
44	Policy not changed.	Operational	N	N
45	Policy not changed.	Operational	N	N
46	Policy not changed.	Operational	N	N
47	Policy not changed.	Operational	N	N
48	Policy not changed.	Operational	N	N
49	Policy not changed.	Operational	N	N
50	Cannot scan Path because the path does not exist.	Operational	N	N
51	Cannot scan Path because it is not a folder.	Operational	N	N
52	Scan not started because a previous scan is still in progress.	Operational	N	N
53	Cannot scan because Sentinel Agent is not running.	Operational	N	N
54	Scan aborted.	Operational	N	N
55	Full Disk Scan started.	Operational	N	N
56	Scan of Path started.	Operational	N	N
57	Scan completed successfully.	Operational	N	N
58	Failed to execute command Command.	Operational	N	N
59	Remote Shell: Error.	Operational	N	N
60	Agent Upgrade: BITS job created for downloading the new Agent.	Operational	N	N
61	Agent Upgrade: BITS download job complete.	Operational	N	N
62	Agent Upgrade: BITS download job failed.	Operational	N	N
63	Agent Upgrade: BITS download job failed.	Operational	N	N
64	Agent Upgrade: BITS is unavailable.	Operational	N	N
65	Agent handled the creation of process Name (PID: PID).	Operational	N	N
66	DB pruning Result.	Operational	N	N
67	Customer ID: customerID.	Operational	N	N
68	Mark as Status on True Context ID TrueContextID received from Deep Visibility.	Operational	N	N
69	Failed to Mark True Context ID TrueContextID as Status.	Operational	N	N
70	Failed to Mark as Status: True Context ID TrueContextID.	Operational	N	N
71	True Context ID TrueContextID was changed from suspicious to threat.	Operational	N	N
72	Failed to Mark as Status: True Context ID TrueContextID.	Operational	N	N
73	Failed to Mark as Suspicious True Context ID TrueContextID.	Operational	N	N
74	Failed to Mark as Status True Context ID TrueContextID.	Operational	N	N
75	Agent handled the termination of process Name (PID: PID).	Operational	N	N
76	Agent encountered invalid pattern: Pattern.	Operational	N	N
77	USB device DeviceName was Action based on SentinelOne Device Control policy.	Operational	N	N
78	Bluetooth device DeviceName was Action based on SentinelOne Device Control …	Operational	N	N
79	Interface device DeviceName was Action based on SentinelOne Device Control …	Operational	N	N
80	The agent encountered an error that is usually ignored, but shouldn't be ignored …	Operational	N	N
81	Scan ended.	Operational	N	N
82	BlueKeep exploitation attempt detected from: IP.	Operational	N	N
83	Resizing the VSS diff area on VolumeName was blocked.	Operational	N	N
84	Blocked PacketDirection connection.	Firewall	N	N
85	Unable to handle configuration change, dropping the configuration	Operational	N	N
86	UI storage reached maximum allowed file size	Operational	N	N
87	UI storage read error ErrorCode "ErrorMessage".	Operational	N	N
88	UI storage write error ErrorCode "ErrorMessage".	Operational	N	N
89	UI storage is corrupted and will be deleted.	Operational	N	N
90	Error deleting corrupted UI storage.	Operational	N	N
91	Remote script orchestrator: script ScriptName execution completed.	Operational	N	N
92	File FilePath was detected as a malicious driver when attempting to load it …	Operational	N	N
93	SentinelCTL command of type "CommandType" was executed - result was: Result.	Operational	N	N
94	Anti-tampering was activated.	Operational	N	N
95	Anti-tampering was deactivated.	Operational	N	N
96	Agent upgrade was initiated.	Operational	N	N
97	Windows Agent is shutting down.	Operational	N	N
98	Sentinel process has crashed.	Operational	N	N
99	Dump file was deleted, as dump limit of DumpFileLimit was reached.	Operational	N	N
100	The agent has successfully connected to the SentinelOne console (ConsoleURL).	Operational	N	N
101	The agent received a "CommandType" command from console.	Operational	N	N
102	Entering disable mode by command.	Operational	N	N
103	Exiting disable mode.	Operational	N	N
104	Event ID 104	Operational	N	N

Event ID 1: Windows Agent is starting in AgentMode mode.

Channel: Operational

Description

Windows Agent is starting in AgentMode mode. Agent version ProductVersion, running on Windows WindowsVersion.

Message #

Windows Agent is starting in %3 mode. Agent version %1, running on Windows %2.

Fields #

Name	Description
`ProductVersion` UnicodeString
`WindowsVersion` UnicodeString
`AgentMode` UnicodeString

Event ID 2: Policy was changed in the Console: %1.

Channel: Operational

Description

Policy was changed in the Console.

Message #

Policy was changed in the Console:



%1

Event ID 3: Policy was changed with override commands: %1.

Channel: Operational

Description

Policy was changed with override commands.

Message #

Policy was changed with override commands:



%1

Event ID 4: Failed to register with management because it no longer exists.

Channel: Operational

Description

Failed to register with management because it no longer exists. Not retrying.

Message #

Failed to register with management because it no longer exists. Not retrying.

Fields #

Name	Description
`ErrorCode` Int32

Event ID 5: Failed to register with management: Reason (ErrorCode).

Channel: Operational

Description

Failed to register with management: Reason (ErrorCode). Retrying in RetrySeconds seconds.

Message #

Failed to register with management: %1 (%2). Retrying in %3 seconds.

Fields #

Name	Description
`Reason` AnsiString
`ErrorCode` Int32
`RetrySeconds` Int32

Event ID 6: Threat remediation: Failed to delete file FilePath because it was already deleted.

Channel: Operational

Message #

Threat remediation: Failed to delete file %1 because it was already deleted.

Fields #

Name	Description
`FilePath` UnicodeString

Event ID 7: Threat remediation: Failed to delete file FilePath.

Channel: Operational

Message #

Threat remediation: Failed to delete file %1.

Error: %2

Fields #

Name	Description
`FilePath` UnicodeString
`Error` UInt32

Event ID 8: Threat remediation: Failed to rename file SourceFilePath to DestinationFilePath because the file was deleted.

Channel: Operational

Message #

Threat remediation: Failed to rename file %1 to %2 because the file was deleted.

Fields #

Name	Description
`SourceFilePath` UnicodeString
`DestinationFilePath` UnicodeString

Event ID 9: Threat remediation: Failed to rename file SourceFilePath to DestinationFilePath because the file's parent directory does not exist.

Channel: Operational

Message #

Threat remediation: Failed to rename file %1 to %2 because the file's parent directory does not exist.

Fields #

Name	Description
`SourceFilePath` UnicodeString
`DestinationFilePath` UnicodeString

Event ID 10: Threat remediation: Failed to rename file SourceFilePath to DestinationFilePath because the destination path already exists.

Channel: Operational

Message #

Threat remediation: Failed to rename file %1 to %2 because the destination path already exists.

Fields #

Name	Description
`SourceFilePath` UnicodeString
`DestinationFilePath` UnicodeString

Event ID 11: Threat remediation: Failed to rename file SourceFilePath to DestinationFilePath.

Channel: Operational

Message #

Threat remediation: Failed to rename file %1 to %2.

Error: %3

Fields #

Name	Description
`SourceFilePath` UnicodeString
`DestinationFilePath` UnicodeString
`Error` UInt32

Event ID 12: Threat remediation: Failed to restore file FilePath to timestamp DesiredTimestamp because no snapshots were found up to the desired period.

Channel: Operational

Message #

Threat remediation: Failed to restore file %1 to timestamp %2 because no snapshots were found up to the desired period.

Fields #

Name	Description
`FilePath` UnicodeString
`DesiredTimestamp` FILETIME

Event ID 13: Threat remediation: Failed to restore file FilePath to timestamp DesiredTimestamp because it is being used by another process.

Channel: Operational

Message #

Threat remediation: Failed to restore file %1 to timestamp %2 because it is being used by another process.

Fields #

Name	Description
`FilePath` UnicodeString
`DesiredTimestamp` FILETIME

Event ID 14: Threat remediation: Failed to restore file FilePath to timestamp DesiredTimestamp because access was denied.

Channel: Operational

Message #

Threat remediation: Failed to restore file %1 to timestamp %2 because access was denied.

Fields #

Name	Description
`FilePath` UnicodeString
`DesiredTimestamp` FILETIME

Event ID 15: Threat remediation: Failed to restore registry value (key: RegistryKeyPath, value: Value) because it does not exist.

Channel: Operational

Message #

Threat remediation: Failed to restore registry value (key: %1, value: %2) because it does not exist.

Fields #

Name	Description
`RegistryKeyPath` UnicodeString
`Value` UnicodeString

Event ID 16: Threat mitigation: Failed to kill malicious processes because the true context does not exist.

Channel: Operational

Event ID 17: Threat mitigation completion after reboot requested another reboot.

Channel: Operational

Message #

Threat mitigation completion after reboot requested another reboot.

True Context ID: %1, Mitigation action: %2

Fields #

Name	Description
`TrueContextID` UnicodeString
`MitigationAction` UnicodeString

Event ID 18: Threat mitigation: Not killing process ProcessName (Path: ProcessPath, Process ID: ProcessID) due to relation Relation.

Channel: Operational

Message #

Threat mitigation: Not killing process %1 (Path: %2, Process ID: %3) due to relation %4.

Fields #

Name	Description
`ProcessName` UnicodeString
`ProcessPath` UnicodeString
`ProcessID` UInt32
`Relation` UnicodeString

Event ID 19: Threat mitigation: Cannot kill process ProcessName (Path: ProcessPath, Process ID: ProcessID) because it is a core OS process.

Channel: Operational

Message #

Threat mitigation: Cannot kill process %1 (Path: %2, Process ID: %3) because it is a core OS process.

Fields #

Name	Description
`ProcessName` UnicodeString
`ProcessPath` UnicodeString
`ProcessID` UInt32

Event ID 20: Threat mitigation: Cannot kill process ProcessName (Path: ProcessPath, Process ID: ProcessID) because it is signed by SentinelOne.

Channel: Operational

Message #

Threat mitigation: Cannot kill process %1 (Path: %2, Process ID: %3) because it is signed by SentinelOne.

Fields #

Name	Description
`ProcessName` UnicodeString
`ProcessPath` UnicodeString
`ProcessID` UInt32

Event ID 21: Threat mitigation: Cannot kill process ProcessName (Path: ProcessPath, Process ID: ProcessID) due to an unknown error.

Channel: Operational

Message #

Threat mitigation: Cannot kill process %1 (Path: %2, Process ID: %3) due to an unknown error.

Fields #

Name	Description
`ProcessName` UnicodeString
`ProcessPath` UnicodeString
`ProcessID` UInt32

Event ID 22: Threat mitigation: Cannot kill threads of process ProcessName (Path: ProcessPath, Process ID: ProcessID) due to an unknown error.

Channel: Operational

Message #

Threat mitigation: Cannot kill threads of process %1 (Path: %2, Process ID: %3) due to an unknown error.

Fields #

Name	Description
`ProcessName` UnicodeString
`ProcessPath` UnicodeString
`ProcessID` UInt32

Event ID 23: Threat mitigation: Failed to quarantine file FilePath because the file is remote.

Channel: Operational

Message #

Threat mitigation: Failed to quarantine file %1 because the file is remote.

Fields #

Name	Description
`FilePath` UnicodeString

Event ID 24: Threat mitigation: Failed to quarantine file FilePath because the file belongs to a core OS process.

Channel: Operational

Message #

Threat mitigation: Failed to quarantine file %1 because the file belongs to a core OS process.

Fields #

Name	Description
`FilePath` UnicodeString

Event ID 25: Threat mitigation: Failed to scramble file FilePath.

Channel: Operational

Message #

Threat mitigation: Failed to scramble file %1.

Error: %2

Fields #

Name	Description
`FilePath` UnicodeString
`Error` AnsiString

Event ID 26: Threat mitigation: skipping quarantine of file FilePath because the file was already quarantined by another threat mitigation.

Channel: Operational

Message #

Threat mitigation: skipping quarantine of file %1 because the file was already quarantined by another threat mitigation.

Fields #

Name	Description
`FilePath` UnicodeString

Event ID 27: Threat mitigation: Failed to quarantine file FilePath because the file does not exist.

Channel: Operational

Message #

Threat mitigation: Failed to quarantine file %1 because the file does not exist.

Fields #

Name	Description
`FilePath` UnicodeString

Event ID 28: Threat mitigation: A reboot is required to complete the quarantine of file FilePath.

Channel: Operational

Message #

Threat mitigation: A reboot is required to complete the quarantine of file %1.

Fields #

Name	Description
`FilePath` UnicodeString

Event ID 29: Threat mitigation: Failed to quarantine a file.

Channel: Operational

Message #

Threat mitigation: Failed to quarantine a file.

Error: %1

Fields #

Name	Description
`Error` AnsiString

Event ID 30: Network quarantine failed.

Channel: Operational

Message #

Network quarantine failed.

Error: %1

Fields #

Name	Description
`Error` AnsiString

Event ID 31: Malware detected!

Channel: Operational

Message #

Malware detected!



True Context ID: %1

Name: %2

Path: %3

Detection engine: %4

Fields #

Name	Description
`TrueContextID` UnicodeString
`Name` UnicodeString
`Path` UnicodeString
`DetectionEngine` UnicodeString

Event ID 32: Mitigation report.

Channel: Operational

Message #

Mitigation report



True Context ID: %1

Action: %2

Result: %3

Fields #

Name	Description
`TrueContextID` UnicodeString
`Action` UnicodeString
`Result` UnicodeString

Event ID 33: Failed to unquarantine file FilePath because the file cannot be found.

Channel: Operational

Message #

Failed to unquarantine file %1 because the file cannot be found

Fields #

Name	Description
`FilePath` UnicodeString

Event ID 34: Unquarantine: Failed to restore file times for FilePath.

Channel: Operational

Message #

Unquarantine: Failed to restore file times for %1.

Error: %2

Fields #

Name	Description
`FilePath` UnicodeString
`Error` AnsiString

Event ID 35: Failed to unquarantine files affected by threat of True Context ID TrueContextID.

Channel: Operational

Message #

Failed to unquarantine files affected by threat of True Context ID %1.

Error: %2

Fields #

Name	Description
`TrueContextID` UnicodeString
`Error` AnsiString

Event ID 36: Network unquarantine failed.

Channel: Operational

Message #

Network unquarantine failed.

Error: %1

Fields #

Name	Description
`Error` AnsiString

Event ID 37: Policy not changed. Verification key not provided.

Channel: Operational

Description

Policy not changed. Verification key not provided. Get the Agent passphrase and enter it with the -k flag.

Message #

Policy not changed. Verification key not provided. Get the Agent passphrase and enter it with the -k flag.

Event ID 38: Policy not changed. The provided verification key is incorrect.

Channel: Operational

Event ID 39: Policy not changed. A parameter cannot be both set and undefined.

Channel: Operational

Event ID 40: Policy not changed. Parameter was not provided.

Channel: Operational

Event ID 41: Policy not changed.

Channel: Operational

Description

Policy not changed. The value Value is not valid for Parameter: invalid URL.

Message #

Policy not changed. The value %2 is not valid for %1: invalid URL.

Fields #

Name	Description
`Parameter` UnicodeString
`Value` UnicodeString

Event ID 42: Policy not changed.

Channel: Operational

Description

Policy not changed. The value Value is not valid. Remove the slash from the end of the URL.

Message #

Policy not changed. The value %2 is not valid. Remove the slash from the end of the URL.

Fields #

Name	Description
`Parameter` UnicodeString
`Value` UnicodeString

Event ID 43: Policy not changed. The provided proxy credentials are invalid.

Channel: Operational

Fields #

Name	Description
`Parameter` UnicodeString

Event ID 44: Policy not changed.

Channel: Operational

Description

Policy not changed. Failed to write value Parameter for UI Language due to error: Value.

Message #

Policy not changed. Failed to write value %1 for UI Language due to error: %2

Fields #

Name	Description
`Parameter` UnicodeString
`Value` UnicodeString
`Error` AnsiString

Event ID 45: Policy not changed.

Channel: Operational

Description

Policy not changed. Invalid UI configuration property Parameter.

Message #

Policy not changed. Invalid UI configuration property %1.

Fields #

Name	Description
`Parameter` UnicodeString

Event ID 46: Policy not changed.

Channel: Operational

Description

Policy not changed. Invalid engine status Value.

Message #

Policy not changed. Invalid engine status %2.

Engine status must be one of: "off", "suppressed", "disable", "local".

Fields #

Name	Description
`Parameter` UnicodeString
`Value` UnicodeString

Event ID 47: Policy not changed.

Channel: Operational

Description

Policy not changed. Invalid parameter Parameter: Error.

Message #

Policy not changed. Invalid parameter %1: %2.

Fields #

Name	Description
`Parameter` UnicodeString
`Error` AnsiString

Event ID 48: Policy not changed.

Channel: Operational

Message #

Policy not changed.

Error: %3.

Parameter: %1

Invalid given value: %2

Fields #

Name	Description
`Parameter` UnicodeString
`Value` UnicodeString
`Error` AnsiString

Event ID 49: Policy not changed.

Channel: Operational

Description

Policy not changed. Cannot undefine parameter Parameter.

Message #

Policy not changed. Cannot undefine parameter %1.

Fields #

Name	Description
`Parameter` UnicodeString

Event ID 50: Cannot scan Path because the path does not exist.

Channel: Operational

Message #

Cannot scan %1 because the path does not exist.

Fields #

Name	Description
`Path` UnicodeString

Event ID 51: Cannot scan Path because it is not a folder.

Channel: Operational

Message #

Cannot scan %1 because it is not a folder.

Fields #

Name	Description
`Path` UnicodeString

Event ID 52: Scan not started because a previous scan is still in progress.

Channel: Operational

Event ID 53: Cannot scan because Sentinel Agent is not running.

Channel: Operational

Description

Cannot scan because Sentinel Agent is not running. Load the Agent and try again.

Message #

Cannot scan because Sentinel Agent is not running. Load the Agent and try again.

Event ID 54: Scan aborted.

Channel: Operational

Event ID 55: Full Disk Scan started.

Channel: Operational

Event ID 56: Scan of Path started.

Channel: Operational

Message #

Scan of %1 started.

Fields #

Name	Description
`Path` UnicodeString

Event ID 57: Scan completed successfully.

Channel: Operational

Event ID 58: Failed to execute command Command.

Channel: Operational

Message #

Failed to execute command %1.

Error: %2

Fields #

Name	Description
`Command` UnicodeString
`Error` UnicodeString

Event ID 59: Remote Shell: Error.

Channel: Operational

Message #

Remote Shell: %1

Fields #

Name	Description
`Error` UnicodeString

Event ID 60: Agent Upgrade: BITS job created for downloading the new Agent.

Channel: Operational

Message #

Agent Upgrade: BITS job created for downloading the new Agent.

Job title: %1

GUID: %2

Destination: %3

Fields #

Name	Description
`BITSJobTitle` UnicodeString
`BITSJobGUID` UnicodeString
`DownloadDestination` UnicodeString

Event ID 61: Agent Upgrade: BITS download job complete.

Channel: Operational

Description

Agent Upgrade: BITS download job complete. Executing installation.

Message #

Agent Upgrade: BITS download job complete. Executing installation.

Job title: %1

GUID: %2

Destination: %3

Fields #

Name	Description
`BITSJobTitle` UnicodeString
`BITSJobGUID` UnicodeString
`DownloadDestinationPath` UnicodeString

Event ID 62: Agent Upgrade: BITS download job failed.

Channel: Operational

Message #

Agent Upgrade: BITS download job failed.

Error: %1 (%2)

Job title: %3

GUID: %4

Fields #

Name	Description
`ErrorMessage` UnicodeString
`ErrorCode` UInt32
`BITSJobTitle` UnicodeString
`BITSJobGUID` UnicodeString

Event ID 63: Agent Upgrade: BITS download job failed.

Channel: Operational

Description

Agent Upgrade: BITS download job failed. Falling back to the classic downloader.

Message #

Agent Upgrade: BITS download job failed. Falling back to the classic downloader.

Error: %1 (%2)

Job title: %3

GUID: %4

Fields #

Name	Description
`ErrorMessage` UnicodeString
`ErrorCode` UInt32
`BITSJobTitle` UnicodeString
`BITSJobGUID` UnicodeString

Event ID 64: Agent Upgrade: BITS is unavailable.

Channel: Operational

Description

Agent Upgrade: BITS is unavailable. Falling back to the classic downloader.

Message #

Agent Upgrade: BITS is unavailable. Falling back to the classic downloader.

Event ID 65: Agent handled the creation of process Name (PID: PID).

Channel: Operational

Message #

Agent handled the creation of process %1 (PID: %2).

Fields #

Name	Description
`Name` UnicodeString
`PID` UInt32
`UID` UnicodeString
`GroupUID` UnicodeString

Event ID 66: DB pruning Result.

Channel: Operational

Message #

DB pruning %1.

Size before: %2

Size after: %3

New DB GUID: %4

Old DB path: %5

New DB path: %6

Fields #

Name	Description
`Result` UnicodeString
`SizeBefore` UInt64
`SizeAfter` UInt64
`NewGUID` UnicodeString
`OldPath` UnicodeString
`NewPath` UnicodeString

Event ID 67: Customer ID: customerID.

Channel: Operational

Message #

Customer ID: %1

Fields #

Name	Description
`customerID` UnicodeString

Event ID 68: Mark as Status on True Context ID TrueContextID received from Deep Visibility.

Channel: Operational

Message #

Mark as %2 on True Context ID %1 received from Deep Visibility

Fields #

Name	Description
`TrueContextID` UnicodeString
`Status` UnicodeString	NTSTATUS reference

Event ID 69: Failed to Mark True Context ID TrueContextID as Status.

Channel: Operational

Message #

Failed to Mark True Context ID %1 as %2.

Error: True Context ID was not found on the Agent

Fields #

Name	Description
`TrueContextID` UnicodeString
`Status` UnicodeString	NTSTATUS reference

Event ID 70: Failed to Mark as Status: True Context ID TrueContextID.

Channel: Operational

Message #

Failed to Mark as %2: True Context ID %1.

Error: Already marked

Fields #

Name	Description
`TrueContextID` UnicodeString
`Status` UnicodeString	NTSTATUS reference

Event ID 71: True Context ID TrueContextID was changed from suspicious to threat.

Channel: Operational

Message #

True Context ID %1 was changed from suspicious to threat

Fields #

Name	Description
`TrueContextID` UnicodeString

Event ID 72: Failed to Mark as Status: True Context ID TrueContextID.

Channel: Operational

Message #

Failed to Mark as %2: True Context ID %1.

Error: Marked as Exclusion

Fields #

Name	Description
`TrueContextID` UnicodeString
`Status` UnicodeString	NTSTATUS reference

Event ID 73: Failed to Mark as Suspicious True Context ID TrueContextID.

Channel: Operational

Message #

Failed to Mark as Suspicious True Context ID %1.

Error: Already marked as Threat

Fields #

Name	Description
`TrueContextID` UnicodeString

Event ID 74: Failed to Mark as Status True Context ID TrueContextID.

Channel: Operational

Message #

Failed to Mark as %2 True Context ID %1.

Error: Status is invalid

Fields #

Name	Description
`TrueContextID` UnicodeString
`Status` UnicodeString	NTSTATUS reference

Event ID 75: Agent handled the termination of process Name (PID: PID).

Channel: Operational

Message #

Agent handled the termination of process %1 (PID: %2).

Fields #

Name	Description
`Name` UnicodeString
`PID` UInt32
`UID` UnicodeString
`GroupUID` UnicodeString

Event ID 76: Agent encountered invalid pattern: Pattern.

Channel: Operational

Message #

Agent encountered invalid pattern: %1.

Fields #

Name	Description
`Pattern` UnicodeString

Event ID 77: USB device DeviceName was Action based on SentinelOne Device Control policy.

Channel: Operational

Message #

USB device %1 was %2 based on SentinelOne Device Control policy



Class: %3

Interface: USB

Vendor ID: %4

Product ID: %5

Serial ID: %6

Device Name: %1

Fields #

Name	Description
`DeviceName` UnicodeString
`Action` UnicodeString
`UsbDeviceClass` UnicodeString
`VendorId` UnicodeString
`ProductId` UnicodeString
`SerialId` UnicodeString

Event ID 78: Bluetooth device DeviceName was Action based on SentinelOne Device Control policy.

Channel: Operational

Message #

Bluetooth device %1 was %2 based on SentinelOne Device Control policy



Class: %3

Minor Class: %4

Interface: Bluetooth

Vendor ID: %5

Product ID: %6

Manufacturer Name: %7

Bluetooth Address: %8

Device Name: %1

Bluetooth Version: %9

GATT Service: %10

Device Information: %11

Fields #

Name	Description
`DeviceName` UnicodeString
`Action` UnicodeString
`DeviceClass` UnicodeString
`DeviceMinorClass` UnicodeString
`VendorId` UnicodeString
`ProductId` UnicodeString
`ManufacturerName` UnicodeString
`BluetoothAddress` UnicodeString
`BluetoothVersion` UnicodeString
`GATTService` UnicodeString
`DeviceInformation` UnicodeString

Event ID 79: Interface device DeviceName was Action based on SentinelOne Device Control policy Info.

Channel: Operational

Description

Interface device DeviceName was Action based on SentinelOne Device Control policy.

Message #

%1 device %2 was %3 based on SentinelOne Device Control policy



%4

Fields #

Name	Description
`Interface` UnicodeString
`DeviceName` UnicodeString
`Action` UnicodeString
`Info` UnicodeString

Event ID 80: The agent encountered an error that is usually ignored, but shouldn't be ignored in automation: Message.

Channel: Operational

Message #

The agent encountered an error that is usually ignored, but shouldn't be ignored in automation: %1

Fields #

Name	Description
`Message` UnicodeString

Event ID 81: Scan ended.

Channel: Operational

Message #

Scan ended.

Scan start time: %1

Scan end time: %2

Scanned %3

Scan triggered by: %4

Total files scanned: %5

Malicious files count: %6

Excluded malicious files count: %7

Scan status: %8

Fields #

Name	Description
`ScanStartTime` FILETIME
`ScanEndTime` FILETIME
`ScannedPath` UnicodeString
`TriggerType` UnicodeString
`ScannedCount` UInt64
`MaliciousCount` UInt64
`ExcludedMaliciousCount` UInt64
`Status` UnicodeString	NTSTATUS reference

Event ID 82: BlueKeep exploitation attempt detected from: IP.

Channel: Operational

Message #

BlueKeep exploitation attempt detected from: %1

Fields #

Name	Description
`IP` UnicodeString

Event ID 83: Resizing the VSS diff area on VolumeName was blocked.

Channel: Operational

Message #

Resizing the VSS diff area on %2 was blocked.

The existing diff area has %3 used bytes and %4 allocated bytes.

The requested new diff area maximum was %5 bytes.

Fields #

Name	Description
`VolumeNameLength` UInt16
`VolumeName` UnicodeString
`OldDiffAreaUsed` Int64
`OldDiffAreaAllocated` Int64
`NewDiffAreaMaximum` Int64

Event ID 84: Blocked PacketDirection connection.

Channel: Firewall

Description

Blocked PacketDirection connection. Rule Id: RuleId Rule Name: RuleName PID: ProcessId Remote Address: RemoteAddress:Port, FQDN: Fqdn.

Message #

Blocked %5 connection. Rule Id: %9 Rule Name: %10 PID: %3 Remote Address: %1:%2, FQDN: %8.

Application Name :%4.

Fields #

Name	Description
`RemoteAddress` UnicodeString
`Port` UInt16
`ProcessId` UInt32
`AppId` UnicodeString
`PacketDirection` UnicodeString
`FilterId` UInt64
`LayerId` UInt16
`Fqdn` UnicodeString
`RuleId` UnicodeString
`RuleName` UnicodeString

Event ID 85: Unable to handle configuration change, dropping the configuration

Channel: Operational

Event ID 86: UI storage reached maximum allowed file size

Channel: Operational

Event ID 87: UI storage read error ErrorCode "ErrorMessage".

Channel: Operational

Message #

UI storage read error %2 "%1"

Fields #

Name	Description
`ErrorMessage` UnicodeString
`ErrorCode` Int32

Event ID 88: UI storage write error ErrorCode "ErrorMessage".

Channel: Operational

Message #

UI storage write error %2 "%1"

Fields #

Name	Description
`ErrorMessage` UnicodeString
`ErrorCode` Int32

Event ID 89: UI storage is corrupted and will be deleted.

Channel: Operational

Event ID 90: Error deleting corrupted UI storage.

Channel: Operational

Event ID 91: Remote script orchestrator: script ScriptName execution completed.

Channel: Operational

Description

Remote script orchestrator: script ScriptName execution completed. Start time: StartTime, duration: Duration milliseconds, exit status: ExitCode.

Message #

Remote script orchestrator: script %1 execution completed. Start time: %2, duration: %3 milliseconds, exit status: %4.

Fields #

Name	Description
`ScriptName` UnicodeString
`StartTime` FILETIME
`Duration` UInt64
`ExitCode` UInt64

Event ID 92: File FilePath was detected as a malicious driver when attempting to load it (Malicious Driver Type: MaliciousDriverType).

Channel: Operational

Message #

File %1 was detected as a malicious driver when attempting to load it (Malicious Driver Type: %2)

Fields #

Name	Description
`FilePath` UnicodeString
`MaliciousDriverType` UInt32

Event ID 93: SentinelCTL command of type "CommandType" was executed - result was: Result.

Channel: Operational

Message #

SentinelCTL command of type "%1" was executed - result was: %2.

Fields #

Name	Description
`CommandType` UnicodeString
`Result` UInt32

Event ID 94: Anti-tampering was activated.

Channel: Operational

Event ID 95: Anti-tampering was deactivated.

Channel: Operational

Event ID 96: Agent upgrade was initiated.

Channel: Operational

Description

Agent upgrade was initiated. (OldVersion -> NewVersion).

Message #

Agent upgrade was initiated. (%1 -> %2)

Fields #

Name	Description
`OldVersion` UnicodeString
`NewVersion` UnicodeString

Event ID 97: Windows Agent is shutting down.

Channel: Operational

Event ID 98: Sentinel process has crashed.

Channel: Operational

Description

Sentinel process has crashed. Dump file path: "DumpPath".

Message #

Sentinel process has crashed. Dump file path: "%1".

Fields #

Name	Description
`DumpPath` UnicodeString

Event ID 99: Dump file was deleted, as dump limit of DumpFileLimit was reached.

Channel: Operational

Description

Dump file was deleted, as dump limit of DumpFileLimit was reached. Dump file path: "DumpPath".

Message #

Dump file was deleted, as dump limit of %1 was reached. Dump file path: "%2".

Fields #

Name	Description
`DumpFileLimit` UInt32
`DumpPath` UnicodeString

Event ID 100: The agent has successfully connected to the SentinelOne console (ConsoleURL).

Channel: Operational

Message #

The agent has successfully connected to the SentinelOne console (%1).

Fields #

Name	Description
`ConsoleURL` UnicodeString

Event ID 101: The agent received a "CommandType" command from console.

Channel: Operational

Message #

The agent received a "%1" command from console

Fields #

Name	Description
`CommandType` UnicodeString

Event ID 102: Entering disable mode by command.

Channel: Operational

Event ID 103: Exiting disable mode.

Channel: Operational

Event ID 104

Channel: Operational

Message #

%1

Fields #

Name	Description
`CommSdkMessage` AnsiString