Overview ✨
Some partners see repeated SentinelOne detections on legitimate Liongard Windows Agent files after an update or reinstall. File hash-based exclusions can become outdated when the agent binary changes, even when the new file is still valid and signed by Liongard.
Where SentinelOne supports it, a signer-based exclusion can reduce these recurring false positives by matching the verified publisher identity on Liongard-signed Windows components.
ℹ️ Recommended approach: Prefer a certificate or publisher-based exclusion for the verified signer Liongard, Inc. instead of repeatedly excluding individual file hashes or specific executable names. This is generally more durable across signed agent updates.
⚠️ Important: Do not assume every SentinelOne exclusion type behaves the same way. Alert suppression, mitigation prevention, quarantine behavior, and execution blocking are separate controls. This article explains the documented behavior and where validation is still recommended.
What We Recommend
Configure a SentinelOne exclusion using the verified Windows signer identity Liongard, Inc..
Field | Recommended value |
Legacy exclusion type | Certificate / Signer Identity |
Unified condition | Publisher |
Operating system | Windows |
Signer / Publisher value | Liongard, Inc. |
Initial scope | Affected site or group |
Purpose | Reduce false-positive detections and mitigation of verified Liongard-signed components |
📕 Use the signer, not the issuer. Liongard documentation identifies Liongard, Inc. as the signer. Issuer details such as Microsoft ID Verified CS EOC CA 01 or Microsoft Corporation are not interchangeable with the signer identity. In SentinelOne, use the verified signer or publisher value shown in the file signature or detection details.
How to Configure the Exclusion
SentinelOne environments may use either the Legacy Exclusions experience or the newer Unified Exclusions experience. The best option depends on what your SentinelOne console exposes and how your security team manages policy.
Option A: Legacy Exclusions using Certificate / Signer Identity
This is the most direct workflow for Liongard-signed Windows Agent components.
Sign in to the SentinelOne Management Console with administrative permissions.
Select the appropriate account, site, or group scope.
Go to Sentinels → Exclusions.
Select New Exclusion → Create Exclusion.
Configure the exclusion with the following values.
Setting | Value |
Exclusion Type | Certificate / Signer Identity |
Operating System | Windows |
Signer Identity / Certificate ID | Liongard, Inc. |
Description (suggested) | Allow verified Liongard-signed Windows Agent components to prevent recurring false-positive detections during agent updates. |
Save the exclusion.
Confirm the exclusion applies to the intended endpoints.
Test with a known Liongard agent update or component refresh.
⚠️ Exact match required: Historical SentinelOne documentation indicates certificate identity values must match exactly and do not support wildcards.
📘 If the Certificate / Signer Identity option is not visible, your tenant may be using the newer exclusions experience. SentinelOne documentation notes that some consoles allow switching through the user profile's Exclusions Experience setting, but availability can depend on console version and permissions.
Option B: Unified Exclusions using Publisher
Use this workflow if your SentinelOne console uses the newer Unified Exclusions interface.
Sign in to the SentinelOne Management Console.
Go to Policy and settings.
Select Exclusion
Select New Exclusion
Select the narrowest appropriate scope (Example : Global)
Set Exclusion Type to Alerts.
Set Operating System to Windows.
Select Continue
Select Create Condition
Choose Publisher as the condition parameter.
Enter Liongard, Inc. exactly within Publisher field
Save the condition and publish the exclusion.
⚠️ Important limitation: Unified Alerts exclusions are documented for alert suppression. Do not assume they will also prevent every quarantine or execution-blocking scenario. If your environment is actively mitigating Liongard files, confirm the supported exclusion behavior with your SentinelOne administrator or SentinelOne Support before broad rollout.
‼️ Note: SentinelOne console navigation, exclusion types, and available settings may vary depending on the console version, permissions, and exclusion management experience (Legacy or Unified). Refer to the official SentinelOne documentation available within your Management Console for the most accurate instructions.
What a Certificate or Publisher exclusion does
Behavior | Certificate / publisher exclusion |
Matches verified signer identity | Yes |
Can continue matching newly signed Liongard versions | Yes, as long as the signer identity remains the same |
Suppresses matching alerts | Yes, in documented exclusion behavior |
May prevent matching mitigation | Documented for Windows certificate exclusions in Legacy behavior; validate in your console |
Disables SentinelOne monitoring entirely | No |
Covers unsigned components automatically | No |
Guarantees all future Liongard-related activity is allowed | No |
This approach can reduce repeated false positives without turning SentinelOne off entirely. SentinelOne can still retain visibility into related events while suppressing alerts or mitigation for matching signed files, depending on the exclusion type in use.
Important Considerations
Signature verification matters. The file must have a valid digital signature that chains correctly on the endpoint. A matching filename alone is not enough.
Publisher exclusions are broader than file exclusions. A signer-based rule can apply to other executables signed by the same publisher, not just one Liongard binary.
Existing quarantines are not automatically undone. If SentinelOne has already quarantined or removed a component, you may need to restore the verified file or reinstall the Liongard Agent after reviewing the detection.
Unsigned child processes are not automatically covered. A publisher exclusion should not be treated as a blanket allow rule for every subprocess, script, third-party executable, or behavioral detection associated with the agent.
Start narrow. Apply the exclusion to the affected site or group first, validate behavior, then expand only if appropriate.
ℹ️ Best practice: If the issue occurs during upgrades, test the exclusion by running or scheduling an agent update after the policy is applied. This helps confirm whether the exclusion only suppresses alerts or also prevents interruption by mitigation controls in your specific SentinelOne configuration.
How to verify the signer value before creating the exclusion
Verify the signer value from one of these sources:
The digital signature details of the affected Liongard executable on the endpoint
The publisher or signer details shown in the SentinelOne detection
Liongard allowlisting guidance for Windows Agent certificate information
📕 Use the exact verified signer value shown by your tools. For Liongard-signed Windows Agent components, the expected signer is Liongard, Inc..
When to Contact Support 🦁
If SentinelOne continues to detect, block, quarantine, or remove Liongard Windows Agent components after configuring the recommended certificate/publisher exclusions, please contact Liongard Support for further assistance.
We also recommend contacting Support if:
SentinelOne continues generating alerts following Liongard Agent updates, despite the exclusion being configured.
The Liongard Agent installation, upgrade, or operation is interrupted by SentinelOne.
SentinelOne quarantines or removes Agent files, preventing the Agent or its components from functioning correctly.
Windows inspections are failing or the Agent is unable to communicate with the Liongard platform.
You are unable to configure the recommended exclusion or are unsure whether it is being applied correctly.
Information to Include in Your Support Ticket
To help our Support team investigate the issue efficiently, please provide the following information:
Detected File Names and Hash Values: Provide the names, full file paths, and SHA-256 hash values of the Liongard Agent files detected or blocked by SentinelOne, if available.
SentinelOne Detection Details: Include the complete SentinelOne detection report, alert details, or threat analysis. Screenshots or exported reports showing the detection name, timestamp, affected file, and mitigation action are especially helpful.
Windows Inspection Status: Confirm whether Windows inspections are completing successfully or failing on the affected system. If inspections are failing, provide the relevant error messages.
Operating System: Specify the Windows operating system and version/build of the affected endpoint (for example, Windows Server 2022 or Windows 11).
Antivirus/EDR Product and Version: Confirm the security product involved (SentinelOne) and the installed SentinelOne Agent version. Include any other antivirus or EDR products installed on the endpoint.
Liongard Agent Version: Provide the installed Liongard Windows Agent version on the affected system.
Action Taken by SentinelOne: Confirm whether SentinelOne blocked execution, quarantined the file, deleted it, or generated an alert without taking further action. If quarantined, indicate whether the file is still available for restoration.
Exclusion Configuration: Confirm whether the recommended Liongard certificate/publisher exclusion has been configured in SentinelOne. Include the exclusion type, configured scope, and a screenshot of the exclusion settings, if possible.
Providing these details will help Liongard Support determine whether the detection is related to an Agent update, an exclusion configuration issue, or another security policy affecting the Agent.
References
Liongard Documentation
SentinelOne Documentation and Resources
SentinelOne Support Portal - Official SentinelOne support resources and product documentation. Authentication may be required.
SentinelOne Management Console — Online Help - Access the product's Online Help from the Management Console for version-specific instructions on Certificate / Signer Identity and Publisher exclusions.
SentinelOne Certificate and Unified Publisher Exclusion Guidance — NinjaOne — Third-party integration guidance covering SentinelOne certificate exclusions and publisher-based alert exclusions.
🚨 Note : We may occasionally provide links to third-party tools or resources for additional reference. These resources are offered for convenience only, and Liongard does not control, maintain, or guarantee their functionality, accuracy, or availability. Please review and use any third-party resources at your own discretion.