How to Enable Deep Visibility in SentinelOne

Issue

I use SentinelOne as my anchor integration. Why do I have a large number of endpoints reporting as not sending telemetry? 

Environment

SentinelOne

Resolution

This is due to Deep Visibility being disabled on the endpoint policy, somewhere in the account/site/group structure.

To correct this, you will need to enable this feature in your SentinelOne Management Console.

1. From the console, navigate to the Sentinels page
2. Click the account, site or group you would like to edit
3. Click the Policy tab
   
4. Scroll down to the Deep Visibility settings
5. Select the Enable Deep Visibility checkbox
6. Enable all toggles except Data Masking
   
7. Enable all File checkboxes within Event Type Configuration:
   

**NOTE: Make sure Data Masking is disabled. If any boxes are left unchecked under Event Type Configuration, a status failure will be triggered in Red Canary.

Cause

SentinelOne uses policy inheritance to control settings throughout the account/site/group structure. If you have a site or group that has policy inheritance disabled, then any changes made at the account level, like enabling deep visibility, will not be inherited.

The Deep Visibility feature is what collects and sends endpoint data to SentinelOne and Red Canary by extension. See How Red Canary integrates with SentinelOne for more information.

For more information on the specific data point slide bars, see the SentinelOne User Guide.