SentinelOne exclusions for TAO

SentinelOne agents may treat a new privileged service and its helpers as suspicious until an exclusions policy is in place. Use the shared list in TAO antivirus and EDR exclusions.

Console names differ by SentinelOne SKU and console generation. Have your SentinelOne administrator map the items below into the exclusions / allowlist policy for the TAO pilot scope.

Paths

• C:\Program Files\Trustity\TAO\
• C:\ProgramData\Trustity\TAO\
• C:\ProgramData\Trustity\

Processes

• tao-agent.exe
• tao-gui.exe
• tao-tray.exe
• tao-lock.exe
• tao-zerodevice.exe
• Trustity-Agent-Setup.exe

Service

• TrustityAgent

Administrator checklist

1. Create or edit an exclusions (or Interoperability) policy for the device group that will run TAO.
2. Add path exclusions for the folders above.
3. Add process / binary exclusions for the executables above when the policy type supports them.
4. Ensure rollback / remediation will not undo an approved TAO install without an operator decision.
5. Push the policy, confirm agents show the updated exclusion set, then install TAO from Deployment.

After a false positive

1. In the SentinelOne console, locate the threat / suspicious activity for Trustity binaries.
2. Mark as false positive / add to exclusions per your change process.
3. Restore any quarantined files if required.
4. Re-run Trustity-Agent-Setup.exe from a current Deployment download and verify SHA-256 when shown.

Validation

sc query TrustityAgent

Expect RUNNING, then confirm Online status and version in Managed devices.

Related links

• TAO antivirus and EDR exclusions
• Install TAO on Windows
• Troubleshoot an offline or stale agent