Skip to content

[Security Soluton][Endpoint] Fix run_sentinelone_host dev script to retry when checking S1 agent status on VM#227067

Merged
paul-tavares merged 1 commit intoelastic:mainfrom
paul-tavares:task/olm-s1-script-fix
Jul 9, 2025
Merged

[Security Soluton][Endpoint] Fix run_sentinelone_host dev script to retry when checking S1 agent status on VM#227067
paul-tavares merged 1 commit intoelastic:mainfrom
paul-tavares:task/olm-s1-script-fix

Conversation

@paul-tavares
Copy link
Copy Markdown
Contributor

@paul-tavares paul-tavares commented Jul 8, 2025

Summary

  • Add retry attempts when getting a status of the SentinelOne agent running on the host VM
    • It seems that it now takes the S1 a bit of time to start up, which was causing the command to get its run status to fail (see error below)

Error:

│ERROR Error: Command failed with exit code 1: multipass exec ptavares-sentinelone-support-3876 -- sudo /opt/sentinelone/bin/sentinelctl control status
   │      Agent must be running in order to execute this command

@paul-tavares paul-tavares self-assigned this Jul 8, 2025
@paul-tavares paul-tavares added release_note:skip Skip the PR/issue when compiling release notes Team:Defend Workflows “EDR Workflows” sub-team of Security Solution backport:version Backport to applied version labels v9.1.0 v8.19.0 v9.2.0 labels Jul 8, 2025
@paul-tavares paul-tavares marked this pull request as ready for review July 8, 2025 15:26
@paul-tavares paul-tavares requested a review from a team as a code owner July 8, 2025 15:26
@elasticmachine
Copy link
Copy Markdown
Contributor

Pinging @elastic/security-defend-workflows (Team:Defend Workflows)

@elasticmachine
Copy link
Copy Markdown
Contributor

💛 Build succeeded, but was flaky

Failed CI Steps

Metrics [docs]

✅ unchanged

cc @paul-tavares

@paul-tavares paul-tavares merged commit d7eb4a2 into elastic:main Jul 9, 2025
26 checks passed
@kibanamachine
Copy link
Copy Markdown
Contributor

Starting backport for target branches: 8.19, 9.1

https://github.com/elastic/kibana/actions/runs/16169773752

kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Jul 9, 2025
… retry when checking S1 agent status on VM (elastic#227067)

## Summary

- Add retry attempts when getting a status of the SentinelOne agent
running on the host VM
- It seems that it now takes the S1 a bit of time to start up, which was
causing the command to get its run status to fail (see error below)

Error:

```
│ERROR Error: Command failed with exit code 1: multipass exec ptavares-sentinelone-support-3876 -- sudo /opt/sentinelone/bin/sentinelctl control status
   │      Agent must be running in order to execute this command

```

(cherry picked from commit d7eb4a2)
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Jul 9, 2025
… retry when checking S1 agent status on VM (elastic#227067)

## Summary

- Add retry attempts when getting a status of the SentinelOne agent
running on the host VM
- It seems that it now takes the S1 a bit of time to start up, which was
causing the command to get its run status to fail (see error below)

Error:

```
│ERROR Error: Command failed with exit code 1: multipass exec ptavares-sentinelone-support-3876 -- sudo /opt/sentinelone/bin/sentinelctl control status
   │      Agent must be running in order to execute this command

```

(cherry picked from commit d7eb4a2)
@kibanamachine
Copy link
Copy Markdown
Contributor

💚 All backports created successfully

Status Branch Result
8.19
9.1

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

kibanamachine added a commit that referenced this pull request Jul 9, 2025
…ipt to retry when checking S1 agent status on VM (#227067) (#227242)

# Backport

This will backport the following commits from `main` to `9.1`:
- [[Security Soluton][Endpoint] Fix `run_sentinelone_host` dev script to
retry when checking S1 agent status on VM
(#227067)](#227067)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Paul
Tavares","email":"56442535+paul-tavares@users.noreply.github.com"},"sourceCommit":{"committedDate":"2025-07-09T12:49:14Z","message":"[Security
Soluton][Endpoint] Fix `run_sentinelone_host` dev script to retry when
checking S1 agent status on VM (#227067)\n\n## Summary\n\n- Add retry
attempts when getting a status of the SentinelOne agent\nrunning on the
host VM\n- It seems that it now takes the S1 a bit of time to start up,
which was\ncausing the command to get its run status to fail (see error
below)\n\n\nError:\n\n```\n│ERROR Error: Command failed with exit code
1: multipass exec ptavares-sentinelone-support-3876 -- sudo
/opt/sentinelone/bin/sentinelctl control status\n │ Agent must be
running in order to execute this
command\n\n```","sha":"d7eb4a217f5ebaa29093073590e8e0281a2e7d3e","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:Defend
Workflows","backport:version","v9.1.0","v8.19.0","v9.2.0"],"title":"[Security
Soluton][Endpoint] Fix `run_sentinelone_host` dev script to retry when
checking S1 agent status on
VM","number":227067,"url":"https://github.com/elastic/kibana/pull/227067","mergeCommit":{"message":"[Security
Soluton][Endpoint] Fix `run_sentinelone_host` dev script to retry when
checking S1 agent status on VM (#227067)\n\n## Summary\n\n- Add retry
attempts when getting a status of the SentinelOne agent\nrunning on the
host VM\n- It seems that it now takes the S1 a bit of time to start up,
which was\ncausing the command to get its run status to fail (see error
below)\n\n\nError:\n\n```\n│ERROR Error: Command failed with exit code
1: multipass exec ptavares-sentinelone-support-3876 -- sudo
/opt/sentinelone/bin/sentinelctl control status\n │ Agent must be
running in order to execute this
command\n\n```","sha":"d7eb4a217f5ebaa29093073590e8e0281a2e7d3e"}},"sourceBranch":"main","suggestedTargetBranches":["9.1","8.19"],"targetPullRequestStates":[{"branch":"9.1","label":"v9.1.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/227067","number":227067,"mergeCommit":{"message":"[Security
Soluton][Endpoint] Fix `run_sentinelone_host` dev script to retry when
checking S1 agent status on VM (#227067)\n\n## Summary\n\n- Add retry
attempts when getting a status of the SentinelOne agent\nrunning on the
host VM\n- It seems that it now takes the S1 a bit of time to start up,
which was\ncausing the command to get its run status to fail (see error
below)\n\n\nError:\n\n```\n│ERROR Error: Command failed with exit code
1: multipass exec ptavares-sentinelone-support-3876 -- sudo
/opt/sentinelone/bin/sentinelctl control status\n │ Agent must be
running in order to execute this
command\n\n```","sha":"d7eb4a217f5ebaa29093073590e8e0281a2e7d3e"}}]}]
BACKPORT-->

Co-authored-by: Paul Tavares <56442535+paul-tavares@users.noreply.github.com>
kibanamachine added a commit that referenced this pull request Jul 9, 2025
…ript to retry when checking S1 agent status on VM (#227067) (#227241)

# Backport

This will backport the following commits from `main` to `8.19`:
- [[Security Soluton][Endpoint] Fix `run_sentinelone_host` dev script to
retry when checking S1 agent status on VM
(#227067)](#227067)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Paul
Tavares","email":"56442535+paul-tavares@users.noreply.github.com"},"sourceCommit":{"committedDate":"2025-07-09T12:49:14Z","message":"[Security
Soluton][Endpoint] Fix `run_sentinelone_host` dev script to retry when
checking S1 agent status on VM (#227067)\n\n## Summary\n\n- Add retry
attempts when getting a status of the SentinelOne agent\nrunning on the
host VM\n- It seems that it now takes the S1 a bit of time to start up,
which was\ncausing the command to get its run status to fail (see error
below)\n\n\nError:\n\n```\n│ERROR Error: Command failed with exit code
1: multipass exec ptavares-sentinelone-support-3876 -- sudo
/opt/sentinelone/bin/sentinelctl control status\n │ Agent must be
running in order to execute this
command\n\n```","sha":"d7eb4a217f5ebaa29093073590e8e0281a2e7d3e","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:Defend
Workflows","backport:version","v9.1.0","v8.19.0","v9.2.0"],"title":"[Security
Soluton][Endpoint] Fix `run_sentinelone_host` dev script to retry when
checking S1 agent status on
VM","number":227067,"url":"https://github.com/elastic/kibana/pull/227067","mergeCommit":{"message":"[Security
Soluton][Endpoint] Fix `run_sentinelone_host` dev script to retry when
checking S1 agent status on VM (#227067)\n\n## Summary\n\n- Add retry
attempts when getting a status of the SentinelOne agent\nrunning on the
host VM\n- It seems that it now takes the S1 a bit of time to start up,
which was\ncausing the command to get its run status to fail (see error
below)\n\n\nError:\n\n```\n│ERROR Error: Command failed with exit code
1: multipass exec ptavares-sentinelone-support-3876 -- sudo
/opt/sentinelone/bin/sentinelctl control status\n │ Agent must be
running in order to execute this
command\n\n```","sha":"d7eb4a217f5ebaa29093073590e8e0281a2e7d3e"}},"sourceBranch":"main","suggestedTargetBranches":["9.1","8.19"],"targetPullRequestStates":[{"branch":"9.1","label":"v9.1.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/227067","number":227067,"mergeCommit":{"message":"[Security
Soluton][Endpoint] Fix `run_sentinelone_host` dev script to retry when
checking S1 agent status on VM (#227067)\n\n## Summary\n\n- Add retry
attempts when getting a status of the SentinelOne agent\nrunning on the
host VM\n- It seems that it now takes the S1 a bit of time to start up,
which was\ncausing the command to get its run status to fail (see error
below)\n\n\nError:\n\n```\n│ERROR Error: Command failed with exit code
1: multipass exec ptavares-sentinelone-support-3876 -- sudo
/opt/sentinelone/bin/sentinelctl control status\n │ Agent must be
running in order to execute this
command\n\n```","sha":"d7eb4a217f5ebaa29093073590e8e0281a2e7d3e"}}]}]
BACKPORT-->

Co-authored-by: Paul Tavares <56442535+paul-tavares@users.noreply.github.com>
kertal pushed a commit to kertal/kibana that referenced this pull request Jul 25, 2025
… retry when checking S1 agent status on VM (elastic#227067)

## Summary

- Add retry attempts when getting a status of the SentinelOne agent
running on the host VM
- It seems that it now takes the S1 a bit of time to start up, which was
causing the command to get its run status to fail (see error below)


Error:

```
│ERROR Error: Command failed with exit code 1: multipass exec ptavares-sentinelone-support-3876 -- sudo /opt/sentinelone/bin/sentinelctl control status
   │      Agent must be running in order to execute this command

```
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport:version Backport to applied version labels release_note:skip Skip the PR/issue when compiling release notes Team:Defend Workflows “EDR Workflows” sub-team of Security Solution v8.19.0 v9.1.0 v9.2.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants