If a security alert is triggered, SentinelOne agent (if set up in Protect mode) will automatically block the threat and quarantine any malicious files. The alert and the associated actions performed by the agent can be found on the SentinelOne user interface under threat history and quarantined files. In a few cases, when the tool is not successful at remediating the threat, designated information security staff at your unit may take further actions such as isolating the device from the network. In such cases, you will be informed by your unit’s IT team.