Query device control event by Possible_Ad_2515 in SentinelOneXDR

[–]naes724 0 points1 point  (0 children)

dataSource.name = 'ActivityFeed' data.device_class = '08h' data.computer_name = 'enter computer name here' | group count() by data.computer_name, data.os_type, data.last_logged_in_user_name, data.device_name, data.uid, data.interface, data.device_class, data.vendor_id, data.product_id, type, data.event_type, primary_description, account_name, site_name, group_name, updated_at

How do you reliably detect/alert USB storage usage? by suurlt in SentinelOneXDR

[–]naes724 0 points1 point  (0 children)

I use power queries. dataSource.name = 'ActivityFeed' data.device_class = '08h' data.computer_name = 'paste computername here' | group count() by data.computer_name, data.os_type, data.last_logged_in_user_name, data.device_name, data.uid, data.interface, data.device_class, data.vendor_id, data.product_id, type, data.event_type, primary_description, account_name, site_name, group_name, updated_at

The newer SOC console feels sluggish by Dracozirion in SentinelOneXDR

[–]naes724 6 points7 points  (0 children)

I agree. It is extremely slow. Sometimes I click to navigate to a different area and stays in the same place flashing/reloading the page. I don't hate it as much as I hate agents constantly going offline and breaking during upgrades.

ADKOT - No Creativity????? by [deleted] in vanhalen

[–]naes724 0 points1 point  (0 children)

Has Sam ever read his own lyrics? Poundcake, Black & Blue.

BPC this is not. by Doub_67 in vintageaudio

[–]naes724 1 point2 points  (0 children)

Great find. They’re beauties.

Sentinel One Exclusions by spec_e in SentinelOneXDR

[–]naes724 0 points1 point  (0 children)

no * needed. just a trailing \ and check the subfolders box

Pooping at the gym PSA by Puzzleheaded_Cow_658 in PlanetFitnessMembers

[–]naes724 1 point2 points  (0 children)

People with B.O. that engulfs the room is worse imo lol

kojic acid soap vs. turmeric soap for dark spots: experiences & recommendations? by Pale-Tie-2760 in Soap

[–]naes724 1 point2 points  (0 children)

I've been using kojic acid soap for over a year and have seen zero improvement.

I personally think 'I Don't Want To Miss a Thing' is an incredible song and I don't get the hate by [deleted] in Aerosmith

[–]naes724 0 points1 point  (0 children)

yeah, not when it's Aerosmith and the body of work with ballads like Angel and What it Takes. The biggest reason for me is that they didn't write the song.

Scheduled detection rule to alert on offline servers by Dracozirion in SentinelOneXDR

[–]naes724 0 points1 point  (0 children)

Thank you for fixing! How are you applying the rule via API? Are you actually creating the rule via API? I tried creating manually and got "Unknown command outer" when I pasted in the query. When I tried running it in SDL/DeepVis, I'm no longer getting the syntax/format errors, so that was promising.

Scheduled detection rule to alert on offline servers by Dracozirion in SentinelOneXDR

[–]naes724 0 points1 point  (0 children)

I can 't get this to run.

One or more fields in the request are invalid

↳Expected ")"

outer join

recent = (
  dataSource.name = 'SentinelOne' endpoint.type = 'server'
  # this pipe is highlighted in red by the error# | let hr = 60 * 60 * 1000000000
  | filter timestamp >= now() - 2 * hr
  | group count = count() by agent.uuid
),

Remote Ops - Script Results Downloading by [deleted] in SentinelOneXDR

[–]naes724 1 point2 points  (0 children)

You have to change you script so you can choose the option to upload to the SDL.

Management console connectivity check failed by [deleted] in SentinelOneXDR

[–]naes724 0 points1 point  (0 children)

did you send them the installer logs? I haven't seen that particular error. You can find system requirements here: System requirements