Companies / SentinelOne / incidents

SentinelOne: Elevated False Positive Alert Activity

Affected components: Singularity Operations Center and Management Console - USA (NA1)USA (NA1)Canada (NA3)Singularity Operations Center and Management Console - Canada (NA3)India (AP3)Singularity Operations Center and Management Console - India (AP3)Australia (AP2)Singularity Operations Center and Management Console - Australia (AP2)Germany (EU2)Singularity Threat Services - Germany (EU2)Singularity Threat Services - USA (NA1)USA (NA1)Australia (AP2)Singularity Threat Services - Australia (AP2)Singularity Operations Center and Management Console - USA (NA4)USA (NA4)Germany (EU1)Singularity Operations Center and Management Console - Germany (EU1)Germany (EU2)Singularity Operations Center and Management Console - Germany (EU2)Singularity Threat Services - USA (NA4)USA (NA4)Canada (NA3)Singularity Threat Services - Canada (NA3)Germany (EU1)Singularity Threat Services - Germany (EU1)India (AP3)Singularity Threat Services - India (AP3)

Timeline of updates

1. monitoring2026-02-02 17:10 UTC

   SentinelOne is monitoring a global false positive event caused by a third-party reputation feed misclassification of a benign file artifact. This resulted in elevated reputation-based detections, alert activity across multiple regions, and, for some customers, network quarantines where enforcement policies are enabled. Mitigation actions have been implemented. Teams continue to monitor platform stability and assist customers with any remaining cleanup. Additional updates will be shared if conditions change.

2. monitoring2026-02-02 20:21 UTC

   SentinelOne has mitigated the third-party reputation misclassification of hash e89cb8f5b2a05b00e85a1f549b0d1e48d148ccbf. We have manually updated our global reputation feed and issued a fleet-wide allowlist to prevent further detections. While infrastructure remains healthy, customers may experience temporary console performance degradation and brief false positive alerts as agents check in to receive the update. These symptoms will subside as the allowlist propagation completes. We will continue to monitor the environment for stability and provide updates should this change.

3. resolved2026-02-02 21:00 UTC

   All services have been fully restored and the incident is now resolved. We have validated that all systems are functioning normally. Thank you for your patience throughout this incident.

Impact, status and times are the vendor’s own, as last archived. View on stspg.io (opens in new tab). SentinelOne profile · Recent SentinelOne incidents · Markdown · JSON