Help with
Sentinel.

Before you beginAn Owner or Admin must arrange enrollment for the correct organization. The person installing the agent needs permission to install software.

1. In Devices, choose Download Agent. Install the approved package using your organization’s deployment instructions.
2. An administrator opens Enroll Device and selects Generate Token. Check its expiry and share the token privately with the person enrolling the device.
3. With the installed agent service running, open the Sentinel app’s Enroll this device prompt. Enter the token and select Enroll. Follow your administrator’s instructions for other enrollment methods.
4. Return to Devices, select Refresh devices and open the device. Check its identity, agent version and Last seen.

Use the full agent installer. A registration or heartbeat script alone does not install the security agent, and a device entry alone does not confirm that protection is running.

If it appears but does not report, check device reporting.

Before you beginIdentify the device and relevant time period. Involve the person responsible for local checks.

1. In Devices, select Refresh devices and open the affected device. Confirm its hostname and identifiers match the endpoint.
2. In Overview, check Last seen and the agent version. Use Timeline to examine activity around the reporting gap.
3. Under Policy, check Endpoint acknowledgement. Distinguish the assigned policy from what the endpoint reports applying.
4. Check power, connectivity and that the installed agent service is running. Follow the approved support process for local service or installation issues.
5. If reporting does not resume, record the device reference, relevant times, exact error and checks performed for support.

Refresh devices updates the console view; it does not restart the agent or run a scan. Avoid changing security settings simply to make the device appear healthy.

Before you beginYou need access to the organization’s security workspace. Response controls depend on role permissions and the endpoint’s state.

1. Under Investigate, open Alerts. Search or filter for the finding and open its row.
2. Check severity, affected device, detection time, status and ownership. Inspect the source process, path or command line where available.
3. Select Open investigation. Read Trigger evidence, Interpretation and Activity. Use Timeline and Attack Map to examine available relationships.
4. For ongoing casework, review Create Case from Incident or Add to Existing Case where available. Retain notes and follow-up ownership.

Related activity is limited to the evidence loaded for review. A queued response is not a completed action, and a relationship in the map does not by itself establish attacker movement.

Before you beginOwner or Admin access is required. Review the existing policy and intended devices before applying a change.

1. Review the policy under Administration → Policies. Open Assets → Device Groups, or Devices → Groups / Manage device groups.
2. In the chosen group’s Policy selector, choose an existing policy or Use Default Policy.
3. In Apply group policy, compare Current and New. Check the group and affected-device count before selecting Apply.
4. In device settings, check Primary Group to identify the group supplying its effective policy. Review any change before selecting Save Changes.
5. After the device next reports, open Overview → Policy and check Endpoint acknowledgement.

For a missing acknowledgement or reporting gap, check device reporting.

Before you beginUse the supported Chromium browser and approved extension process. Obtain organization connection details and a scoped extension API key from an administrator.

1. In Risk & Intelligence → Browser Protection, select Download Extension (.zip) and extract the archive.
2. Open the browser’s extensions page, such as chrome://extensions. Enable Developer mode, select Load unpacked and choose the extracted folder.
3. Open Manual setup in the extension settings. Enter the organization’s API endpoint and Organization ID from Browser Protection, plus the administrator-provided extension API key.
4. Select Test Connection and check the result. Once connected, review extension settings and reported activity in Sentinel.

Treat the extension API key as a credential. Do not substitute a project publishable key or service-role key, or include keys in screenshots, support requests or shared examples.

For the browser loading steps, see Chrome’s unpacked-extension instructions.

Before you beginUse an account with asset-review access. Start with observed evidence; management status alone does not establish authorization.

1. In Assets → Discovered Assets, search by IP, MAC or endpoint name. Use management, review-status and confidence filters as needed.
2. Open the asset and inspect its Status, Matched endpoint, Reporters, Observations, Confidence and Last seen.
3. In Asset Review, record the applicable workflow status, disposition, owner or responsible team, business purpose and review notes.
4. Review the entry, then select Save review. Include enough context for another reviewer to understand the decision.

This guide covers review and ownership. It does not establish that an unenrolled asset can be remotely isolated or scanned.

See asset discovery and exposure for capability scope.