Endpoint protection exclusions for Sentinel Host

What to exclude in your antivirus, endpoint detection and TLS inspection products so the Sentinel Host agent can register, report and update. Covers the domains, folders, processes and ports the agent uses, the check that names the product in the way, and where the setting lives in the most common products.

The Sentinel Host agent connects out to the WASViking^® cloud over mutual TLS and never opens an inbound port. That design survives firewalls and proxies well, with one exception every fleet eventually meets: a security product that terminates and re-signs TLS traffic on the machine or on the network. Mutual TLS cannot pass through a re-signed connection by design, so the agent registers and then never sends its first inventory, or does not even register. The portal shows the enrollment as "Never reported" or "Token never used".

This page lists exactly what to exclude, how to confirm it worked, and where the setting usually lives. Apply it before installing on servers behind endpoint protection or a web gateway, or as soon as an enrollment stalls.

The rule of thumb

Exclude the WASViking domains from TLS inspection, and exclude the agent's binary and data folder from real-time scanning and behavioral blocking. Do not turn off the product's global scanning or its TLS inspection for everything else; a narrow exclusion is all the agent needs.

What the agent uses

Domains. Exempt *.wasviking.com from TLS inspection, or at least these two names:

Folders and processes.

The Windows service is named WASVikingSentinelHost; on Linux the unit is wasviking-sentinel-host.service; on macOS the daemon label is com.wasviking.sentinel-host. When the product supports trusted applications or process exclusions, add the binary path; when it only supports folders, add the binary folder and the data directory. The data directory holds the agent's certificate, its state and its logs, and the agent writes there every cycle.

Why the binary matters too. Agent updates arrive as a new binary downloaded from api.wasviking.com and swapped into place. A product that quarantines unknown executables can stop an update the same way it stops a first install.

Confirm before and after

On the host, run the check as an administrator:

wasviking-sentinel-host check

The verdict names the product re-signing TLS when there is one ("TLS interception detected ... signed by "), tells a DNS filter from a captive portal, and proves the mutual TLS channel end to end once the exclusion is in place. Since agent 0.1.29 the installer runs the same probes before registering and stops on a blocked path, so a failed install leaves nothing behind on the platform.

After the exclusion, do not mint another token or run the installer again: the agent already installed reconnects on its own within minutes. A reinstall on the same machine resumes the same asset.

Where the setting lives

The names below are the products' own. Menus move between versions, so treat the path as a pointer to the right screen and search the product's documentation for "trusted domains", "SSL inspection exclusions" or "exclusions" when it differs.

Kaspersky Endpoint Security (Security Center or Cloud console). Open the security profile applied to the host, pick the operating system tab, then General settings, Network settings. Under "Encrypted connections scan", add *.wasviking.com to Trusted domains. Under Trusted applications, add the agent binary with "Do not scan network traffic", and add the binary folder and the data directory as scan exclusions. Keep the global scan on.

Microsoft Defender for Endpoint and Defender Antivirus. Through Intune or Group Policy, add the agent binary as a process exclusion and the data directory as a folder exclusion. Defender does not re-sign TLS, so the domains rarely need anything; if Network Protection or a web content filter is in place, allow the two domains there.

CrowdStrike Falcon. Falcon does not intercept TLS. If the sensor blocks or quarantines the agent, create a Machine Learning exclusion or an IOA exclusion for the binary path and the data directory in the Exclusions area of the console.

SentinelOne. Add a path exclusion for the binary and the data directory in the policy's Exclusions, with interoperability mode if the agent's updates keep getting flagged.

Sophos (Intercept X, Central and Sophos Firewall). In Central, add the binary and data directory to Global Exclusions. If SSL/TLS decryption is on at the firewall or in the endpoint web control, add *.wasviking.com to the decryption exclusions.

ESET (Endpoint Security and PROTECT). Under Web and email, SSL/TLS filtering, add the agent binary to the list of applications excluded from filtering, and add the binary folder and data directory as real-time exclusions.

Bitdefender GravityZone. In the policy, add the paths to Exclusions and, if "Encrypted web scan" is enabled, exclude *.wasviking.com.

Trend Micro Apex One and Vision One. Add the paths to the exception list, and if Web Reputation inspects HTTPS, add the domains to its approved list.

Zero Trust and web gateways (Zscaler, Netskope, Cloudflare Gateway, Cisco Umbrella). Add *.wasviking.com to the SSL inspection bypass list, sometimes called "Do not decrypt". The host client of these products is a frequent cause on laptops and jump hosts.

Firewalls with decryption (Palo Alto, Fortinet, Check Point, WatchGuard). Add the two domains to the decryption exclusion list of the policy that covers the server's egress.

Still stuck

Send the support bundle the check writes (wasviking-host-check_<host>_<utc>.json and .txt) to your WASViking contact. It carries the certificate chain the host saw, the processes that can filter traffic, and the agent's recent log lines, with no secrets.