Host checker with sentinel one

[kobib]

Hi,

I tried to apply a host checker on all endpoints in my company.

But I get an error: "Anti-Virus software listed in security requirements is not installed."

But I have sentinel one agent on all endpoints.

[kobib]

attached screenshot with my configuration:

authantication -> endpoints security -> host checker:

I created new policy with the following details - https://i2.paste.pics/I1I62.png

Users -> user rules -> I have selected the rule of the relevant user, and I added this following details -

 https://i2.paste.pics/I1I7Y.png

[zanyterp]

what version of esap are you using?
what version of the appliance software are you using?
do you have anti-virus version monitoring enabled?
if you have not done so yet, please open a case with our support team with the following data:

• Save all logs from System>Log/Monitoring>Events>Log
• Pulse client logs with annotation prior to login/indicating the start point and then once the error has happened
• System snapshot set to include debug log and system config with the following values configured:
  — Enabled: True
  — Log size: 500
  — Log level: 30
  — Event codes (space-, comma-, case-sensitive): Welcome,SignIn,Realm,Authenticate,Auth,TNCS,HC,DSLiveUpdate,agentman,sbr,opswat

[kobib]

what version of esap are you using? 9.1.15

what version of the appliance software are you using? Are you asking about the version of the antivirus? Sentinel One  version 22.1.2.217

do you have anti-virus version monitoring enabled? how can I check that?

[zanyterp]

Thank you for confirming the PCS/ICS version (9.1R15). The ESAP version is checked at Authentication>Endpoint Security>Host Checker
version monitoring is checked at Authentication>Endpoint Security>Host Checker, Version Monitoring

[kobib]

Currently Active ESAP version: 3.4.8

[zanyterp]

thank you; can you test with the most recent version to see if this has been addressed? (it should be 4.0.4)