RCA / SENTINELONE / AGENT HEALTH
SentinelOne agent
offline.
A structured RCA for endpoints that stop reporting to the SentinelOne management plane.
Endpoint not reporting
Console last-seen state is stale while the endpoint may still be powered on and in use.
Check before changing policy
Capture service state, agent logs, DNS resolution, proxy configuration, outbound connectivity and timestamps.
Separate one device from a fleet
Compare affected and healthy endpoints on the same network, policy and agent version.
INVESTIGATION
Follow the communication path.
01Service
02DNS
03Proxy
04Network
05Console
06Verify
Root-cause pattern
When the endpoint service is healthy but reporting is stale, the investigation moves outward: name resolution → proxy path → outbound connectivity → cloud communication. Do not assume an agent defect until the network path is evidenced.