ICS-6000 DC Communications Disrupted by SentinelOne
Error Code
{DC} Error receiving data: Module did not respond in a timely manner. Please check that your USB cables are securely connected and that the module and any USB hubs are powered on.
Environment
SentinelOne is not provided with the instrument's PC. The default anti-malware software is Microsoft Defender. SentinelOne has been found to obstruct communications with ICS-6000 systems.
See this KA for additional details:
Cause
Replace this text to add the Cause of the Error Code.
SentinelOne is a cybersecurity platform designed to provide endpoint protection, detection, and response. It uses artificial intelligence and machine learning to detect and mitigate cyber threats in real-time. In some systems, SentinelOne has interfered with TCP/UDP and USB communications.
In the case of TCP/UDP disruption, SeninelOne is likely blocking port traffic, acting as a firewall with the symptom being a mass spectrometer will not communicate with it's Tune application (ICSW).
In the case of USB disruption, SentinelOne is reported to be able to replace the USB device's driver. For a Chromeleon based system, communication between the IPC and the hardware may not be possible, or it may be possible only intermittently. The primary symptom is an inability to Connect to the hardware in the Chromeleon Console.
Resolution Steps
To restore communication, the customer must have their IT department uninstall, suspend, or reconfigure SentinelOne. There are two reasons for this. First, this software is not supported for use with the Thermo Scientific hardware fleet. Second, SentinelOne requires a Windows Administrator with knowledge of the SentinelOne administrator password to fully disable.
We've had cases customers updating the Sentinel Agent to at least version 24.1.257 with success.
