fix sentinelone check in edr policy (#439)

Signed-off-by: Patrick Münch <[email protected]>
mondoohq · Oct 2, 2024 · 42b693b · 42b693b
1 parent 3dc7c00
commit 42b693b
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/core/mondoo-edr-policy.mql.yaml b/core/mondoo-edr-policy.mql.yaml
@@ -3,7 +3,7 @@
 policies:
   - uid: mondoo-edr-policy
     name: Mondoo Endpoint Detection and Response (EDR)
-    version: 1.3.1
+    version: 1.4.0
     license: BUSL-1.1
     tags:
       mondoo.com/category: security
@@ -95,7 +95,7 @@ queries:
     filters: asset.family.contains('linux')
     mql: |
       package('falcon-sensor').installed ||
-      ['SentinelAgent', 'sentinelagent'].all(package(_).installed) ||
+      ['SentinelAgent', 'sentinelagent'].any(package(_).installed) ||
       file('/opt/eset/RemoteAdministrator/Agent').exists
   - uid: mondoo-edr-policy-ensure-edr-agent-is-installed-windows
     filters: asset.family.contains('windows')