Skip to main content

Configuring SentinelOne Exclusions for Swif.ai to Prevent False Positives

Updated over a week ago

Why Exclude Swif.ai Paths in SentinelOne?
Swif.ai’s device and software management tools may be flagged as “suspicious” by SentinelOne due to legitimate low-level system interactions. While Swif.ai is not blocked by default, adding these exclusions ensures uninterrupted operations and avoids unnecessary alerts.


Steps to Add Swif.ai Exclusions in SentinelOne

  1. Log in to the SentinelOne Management Console
    Navigate to your SentinelOne dashboard with administrator privileges.

  2. Create a New Exclusion Policy

    • Go to Policies > Exceptions.

    • Click Add Exception.

  3. Exclude Swif.ai File Paths
    Add the following paths to the File Path exclusion list. Ensure “Recursive” is enabled to cover all subfolders:

    Windows

    C:\Program Files\Swifteam\swifteam.exe 
    C:\Program Files\Swifteam\gorilla.exe
    C:\ProgramData\Swifteam\swifteam.exe
    C:\ProgramData\Swifteam\gorilla.exe
    C:\ProgramData\gorilla
    C:\Users\{{USER}}\AppData\Local\gorilla

    C:\Program Files\Swifteam\swifteam.exe:
    This is the Swif agent binary installed on the device. Most management operations are handled through the associated service called STService. The primary functions include:

    • Retrieving device information

    • Managing certain policies

    • Handling local user operations

    • Live Terminal

    C:\Program Files\Swifteam\gorilla.exe:
    This binary is used for Application Management operations on the device. It is associated with the STGorilla service.
    Cloned versions of these binaries are also available under the C:\ProgramData\Swifteam\ directory. Since the Program Files directory may have restricted access for some users, the agent automatically copies both swifteam.exe and gorilla.exe into ProgramData.
    Through Swif's task execution system, when operations require USER-level permissions, the binaries located under C:\ProgramData\Swifteam\ are invoked.

    macOS

    /usr/local/swifteam/swifteam

    Linux

    /usr/bin/swifteam
    /usr/bin/systemcheck
  4. Save the Policy
    Assign the policy to relevant device groups or apply it globally.


Verify the Exclusions

  1. On a managed device, open the SentinelOne agent.

  2. Navigate to Settings > Exclusions to confirm the Swif.ai paths are listed.


Need Help?

If Swif.ai is still flagged or you have questions, contact our support team at support@swif.ai.


Note: These exclusions do not compromise security—they ensure Swif.ai operates smoothly while SentinelOne continues to protect your environment.

Did this answer your question?