SentinelOne monitors all applications on your system for signs of malicious activity, but it cannot access those applications. It tracks the names and versions of installed applications to identify security vulnerabilities on them. In addition, SentinelOne maintains a log of activities related to services and applications running at any given time. This is needed to track progress of malicious activity and, ideally, roll back any unauthorized changes. Information about process/application activity is only used for the purposes of security threat detection and is automatically deleted in accordance with the retention policy.