json
/var/log/sentinelone.json
Logs from SentinelOne.
100600
detect
SentinelOne: New active threat $(threatInfo.threatName) detected on $(agentRealtimeInfo.agentComputerName).
100600
mitigated
SentinelOne: Threat $(threatInfo.threatName) successfully mitigated on $(agentRealtimeInfo.agentComputerName).
100600
[4-9]\d*|\d{2,}
SentinelOne: Multiple active threats detected on $(agentRealtimeInfo.agentComputerName).
100600
true
SentinelOne: System reboot required on $(agentRealtimeInfo.agentComputerName) to complete actions.