Category: How does SentinelOne Endpoint Security work? / Can SentinelOne protect endpoints if they are not connected to the cloud?
The SentinelOne agent is designed to work online or offline. The agent on the endpoint performs static and dynamic behavioral analysis pre- and on-execution.
These two methods are the principal prevention and detection methods in use and do not require internet connectivity. However, when the agent is online, in addition to the local checks, it may also send a query to the SentinelOne cloud for further checking.