🧩 Important Status Note
A permanent fix is in progress.
Our development team is actively working on a platform-level change that will prevent SentinelOne from incorrectly classifying the Liongard Agent installer or its embedded components as threats.
We will update this article once the fix is released.
🔍 Root Cause
SentinelOne is currently flagging the Nmap component packaged with the Liongard Agent installer.
What SentinelOne Is Detecting
SentinelOne identifies the following file as malicious and quarantines it:
C:\Program Files (x86)\LiongardInc\LiongardAgent\nmap\nmap-7.97-oem-setup.exe
In some cases, SentinelOne may also flag temporary installation-related files, such as:
C:\Config.Msi\<random>.rbf
❓Why This Happens
Liongard includes a lightweight, embedded version of Nmap for network discovery functions.
Some antivirus products classify Nmap packages as “hacking tools” by default, even when bundled legitimately inside trusted software.
SentinelOne’s heuristic engine is prematurely terminating the installer and quarantining the affected files.
🛠️ Impact
When the Nmap component is quarantined:
The Liongard Agent installer may fail or complete only partially.
Subsequent updates or inspections that rely on Nmap may not run correctly.
RMM or endpoint logs may show blocked/quarantined events related to the Liongard Agent.
⚡ Short-Term Mitigation
Allowlist the Liongard Agent and installer within SentinelOne.
Recommended Actions
Follow the allowlisting guidance in our official documentation:
Allowlisting prevents the quarantining of the Nmap component and ensures normal installation and operation of the Agent.
📌 Additional Notes
This behavior is limited to SentinelOne and does not indicate an actual security threat.
The Nmap package shipped with the Agent is vendor-signed, safe, and used exclusively for inspection purposes within the Liongard platform.