Standard Operating

Procedure For
SentinelOne SOP for How To Trobleshoot
Offline Agents.
There are multiple resons for SnetinelOne Agent showing offline in Mangement Console.

Step-1-We will use the Windows Command prompt with Run As Administrator.

1. Press the Windows Start Key & Enter: cmd

2. Right-Click Command Prompt & Then select Run as administrator.

Network Connectivity Test

 From any SentinelOne agent,ping our S1 Management URL and see it results.

ping apne1-1101-nfr.sentinelone.net

If result we get ping time out,but resolves to IP address,it means the ping is successful.

 Telnet to our Management URL on port 443.

telnet apne1-1101-nfr.sentinelone.net 443

 Check if third-party Av solutions on the endpoint.If yes then exclue the sentinelone
agent folder from scanning.

C:\Program Files\SentinelOne\ Agent Version (Sentinel Agent 22.2.5.806)

 Check the proxy server is configured correctly.

Page 2 of
6Internal & Confidential
SentinelOne Agent Service Test

 Check all servies are up & running related to Sentinelone agent.Check the below
screenshot for your refrences.


 We can check Agent & Monitor services are running or not with the help of the below
command.

C:\Program Files\SentinelOne\Sentinel Agent 22.2.5.806>SentinelCtl status

Check the output is always shows Loaded and Running.

Page 3 of
6Internal & Confidential
SentinelOne Event Viewer

We can also check SentinelOne Agent logs in Windows Event Viewer.

 Click StartRuneventvwr.msc

 In The Event Viewer (Local)ClickApplication and Services

LogsSentinelOneOperational

Check the Error ID. E.g registration failed due to invalid certificate or any other connection issues.

End of Document
********************

Page 4 of
6Internal & Confidential
 Page 5 of
6Internal & Confidential
 Page 6 of
6Internal & Confidential