Where Does SentinelOne Store Agent Data?
Where SentinelOne agent keeps data and logs on Windows and computers. Full paths are listed below. More below.
Last updated
SentinelOne is EDR cloud with a local agent. Your console holds endpoints, threats, and quarantine. Each computer holds agent state, policy cache, and support logs.
Same site token means same fleet. Exact agent folder names shift with Windows versus Mac builds and versions. Keep online during incidents so telemetry uploads. If endpoints vanish, check the site token first. A test site twin is the usual empty fleet cause. Check the in app storage readout when sizes look wrong on different releases.
Where SentinelOne Agent stores this, by platform
C:\Program Files\SentinelOne (agent state, detections in cloud)
Detections follow your SentinelOne console site. Agent holds state plus support logs. Uninstalls never touch cloud timelines. Match the site token exactly.
Frequently asked questions
Does uninstalling SentinelOne delete detections?
No. The agent streams detections to your SentinelOne cloud console and caches policy locally. The computer holds agent state plus support logs. Uninstalls remove local state but never delete cloud threats or quarantine history. Export reports from the console for records.
Where is SentinelOne detection history?
In the management console cloud with full timeline per endpoint. The agent holds a working copy plus support logs. Detections rebuild in the console after reinstall. Collect the support bundle from the agent folder for tickets.
Notice an outdated path? Let us know.