I'm planning to open a support ticket, but I'm curious whether anyone else has dealt with SentinelOne sending thousands of emails for a single remediation event. In this case, SentinelOne terminated and remediated a Dell SupportAssist process once, then generated roughly 4,300 notification emails over the course of the morning. Has anyone found a reliable way to stop this kind of alert storm or prevent it from happening again?
4 Answers
We’ve had smaller versions of this, around 500 messages at a time. Support may treat each email as an individual event, so be very explicit that the problem is the notification storm, not just the original detection. Afterward, review whether Dell SupportAssist should be excluded or handled differently, assuming it’s approved in your environment.
We’ve seen this when one device keeps generating notifications for the same alert. If the issue has already stopped, open the affected device in the console and try the option to randomize its UUID. That can break the repeated association and prevent the messages from continuing.
This has happened to us several times. A broad Windows remediation can sometimes produce an alert for every endpoint or every event connected to it, which turns into a massive email flood. It’s worth checking the notification settings in the policy that triggered the remediation to see whether alerts can be throttled or batched.
Not quite 4,300, but we once ended up with more than 1,200 notifications from a similar remediation loop. It seems to be an occasional product issue rather than a one-off configuration mistake.
That matches what we’re seeing—the remediation itself completed, but the notifications kept multiplying afterward.