S1 Agent Download: A Step-by-Step Guide to Install and Configure SentinelOne Endpoint Protection
Introduction
If you are looking for a comprehensive solution to secure your Windows server endpoints across multiple clouds, you might want to consider S1 agent, a component of SentinelOne Cloud Workload Security. S1 agent is an advanced tool that provides prevention, detection, response, and investigation capabilities for your hybrid cloud Windows server infrastructure. In this article, you will learn what S1 agent is, why you need it, what are its benefits and features, how to download it, and how to use it.
S1 agent is a lightweight software that runs on your Windows server endpoints, whether they are physical or virtual machines in your data center or at AWS EC2, Azure, or Google Cloud. S1 agent leverages artificial intelligence (AI) and machine learning (ML) to protect your endpoints from file-based and fileless attacks in real time, without relying on cloud connectivity or signatures. S1 agent also provides full endpoint detection and response (EDR) visibility, with massive data retention and automated event correlation. With S1 agent, you can easily investigate and respond to threats, using features such as secure remote PowerShell, one-click remediation, one-click rollback, firewall control, network isolation, and file fetch.
download s1 agent
Some of the benefits of using S1 agent are:
Hybrid cloud VM endpoint security: You can consolidate your security across different cloud environments and manage them from one single console.
Real time prevention: You can stop known and unknown threats before they compromise your endpoints, using AI-powered engines that analyze thousands of concurrent OS stories.
Reduced mean time to repair (MTTR): You can quickly remediate and rollback any malicious changes on your endpoints, using patented one-click actions that require no scripts.
Full EDR visibility: You can access up to 365 days of EDR data retention and leverage MITRE ATT&CK technique integration for threat hunting and analysis.
Accelerated investigation: You can use Storyline technology to automatically correlate all software operations in real time at the endpoint and build actionable context for every linked process.
Less alert fatigue: You can reduce false positives and focus on the most relevant alerts, using Storyline Active Response (STAR) automation that triggers responses on-agent in real time.
How to download S1 agent
To download S1 agent, you need to have an account with SentinelOne and access to their console. If you don't have an account yet, you can request a demo or a free trial from their website. Once you have an account, you can follow these steps:
Log in to the SentinelOne console with your credentials.
Go to Settings > Agents & Groups > Download Agent. You will see a list of available agent versions for different operating systems and architectures.
Select the version that matches your Windows server OS and architecture. For example, if you have a Windows Server 2019 64-bit, you can choose the Windows x64 version.
Click on the download icon next to the version you want. You will see a pop-up window with the download link and the passphrase. Copy both of them and save them somewhere safe.
Go to the Windows server endpoint where you want to install S1 agent. Open a web browser and paste the download link in the address bar. You will be prompted to enter the passphrase. Enter it and click OK.
The S1 agent installer file will start downloading. Once it is downloaded, run it as an administrator and follow the instructions on the screen. You will need to accept the license agreement and choose a destination folder for the installation.
After the installation is complete, you will see a confirmation message that S1 agent is installed and running on your endpoint. You can also check the status of S1 agent in the system tray or in the Services app.
How to use S1 agent
Once you have installed S1 agent on your Windows server endpoints, you can start using it to protect, detect, and respond to threats. Here are some of the things you can do with S1 agent:
How to access the SentinelOne console and manage your devices
The SentinelOne console is the web-based interface where you can view and manage all your endpoints that have S1 agent installed. You can access the console from any device with an internet connection and a web browser. To access the console, follow these steps:
Go to and log in with your credentials.
You will see a dashboard that shows an overview of your security posture, such as the number of endpoints, threats, alerts, incidents, and policies.
You can use the menu on the left side to navigate to different sections of the console, such as Devices, Threats, Incidents, Policies, Reports, Settings, and Help.
You can use the search bar on the top right corner to find specific devices, threats, incidents, or policies by name, IP address, hostname, group, tag, or status.
You can use the filters on the right side to narrow down your results by various criteria, such as OS, agent version, threat score, risk level, or policy name.
You can use the actions menu on the bottom right corner to perform various actions on your devices, such as scan, isolate, remediate, rollback, uninstall, or fetch files.
How to use the SentinelCtl command line tool to perform actions on S1 agent
SentinelCtl is a command line tool that allows you to perform various actions on S1 agent from a remote PowerShell session. You can use SentinelCtl to scan for threats, update policies, enable or disable features, collect logs, and more. To use SentinelCtl, follow these steps:
Open a PowerShell session on your Windows server endpoint where S1 agent is installed. You can use either PowerShell or PowerShell Core.
Navigate to the folder where S1 agent is installed. By default, it is C:\Program Files\SentinelOne\Sentinel Agent 4.x.x\
Type .\SentinelCtl.exe followed by the action you want to perform and any parameters you want to specify. For example, if you want to scan for threats with high sensitivity level and verbose output mode, you can type .\SentinelCtl.exe scan --sensitivity high --verbose
Press Enter and wait for the action to complete. You will see a message indicating whether the action was successful or not.
You can type .\SentinelCtl.exe --help to see a list of all available actions and parameters.
How to use the Storyline feature to investigate and respond to threats
Storyline is a unique feature of S1 agent that allows you to investigate and respond to threats in a visual and intuitive way. Storyline automatically correlates all software operations in real time at the endpoint and builds actionable context for every linked process. You can use Storyline to see how a threat started, what it did, how it spread and how you can stop it. To use Storyline, follow these steps:
How to install s1 agent on Windows Server
SentinelOne s1 agent command line tool
S1 agent download link for Linux
S1 agent configuration and policy update
S1 agent uninstallation and removal guide
S1 agent compatibility and version support
S1 agent firewall control and network isolation
S1 agent scan folder and disk options
S1 agent status and connection check
S1 agent rollback and remediation features
S1 agent static AI and behavioral AI engines
S1 agent Storyline Active Response (STAR)
S1 agent integration with MITRE ATT&CK framework
S1 agent data retention and storage settings
S1 agent application inventory and reporting
S1 agent anti-tampering and protection mode
S1 agent IE protection enable or disable
S1 agent Windows Security Center registration
S1 agent remote PowerShell access and commands
S1 agent quarantine and unquarantine network
How to update s1 agent on AWS EC2 instances
SentinelOne s1 agent cloud workload security
S1 agent download link for Kubernetes clusters
S1 agent configuration and policy sync
S1 agent uninstallation and cleanup script
S1 agent compatibility and system requirements
S1 agent network traffic and bandwidth usage
S1 agent scan file and process options
S1 agent status and health check
S1 agent rollback and restore features
S1 agent Static AI and Behavioral AI settings
S1 agent Storyline event correlation and visualization
S1 agent integration with third-party tools and platforms
S1 agent data encryption and security standards
S1 agent application control and whitelisting
S1 agent anti-tampering and unprotect mode
S1 agent IE protection configuration and troubleshooting
S1 agent Windows Security Center alerts and notifications
S1 agent remote PowerShell script execution and logging
S1 agent quarantine and unquarantine file or process
Log in to the SentinelOne console and go to Threats > Storyline.
You will see a timeline of all the threats detected by S1 agent on your endpoints. You can use the filters on the right side to narrow down your results by various criteria, such as threat score, risk level, MITRE ATT&CK technique, or device group.
Click on any threat to see its details and its Storyline. You will see a graphical