Overview
...
Armor Agent and sub-agent health status change during the various steps of installation & uninstallation. These statuses are reflected in the following diagrams:
Armor Agent
...
State: OK
Message: N/A
Description: After installation, if the Armor Agent is functioning correctly and sending regular heartbeats, the state is marked as "OK."
State: Needs Attention
Message: The Armor Agent has not sent a heartbeat in the past 4 hours.
Description: If the Armor Agent fails to send a heartbeat within a 4-hour window, the state changes to "Needs Attention."
Action for State: Needs Attention
Turn VM Off: If the VM is turned off, the process should turn it back on.
Turn VM On: Once the VM is turned on, the process reverts to checking the "State: OK."
This process ensures continuous monitoring and timely attention if the Armor Agent fails to send a heartbeat, indicating potential issues with the VM or the agent itself.
File Logging/Windows Event Logging
...
...
State: N/A
Message: Disabled - The customer opted out of this service.
Description: After installation, if the customer has opted out of the logging service, the state is marked as "N/A" with a message indicating the customer’s decision. Logging services are not installed in this case.
State: OK
Message: No message.
Description: If the Armor Agent and logging services (if opted in) are functioning correctly, the state is marked as "OK" with no additional messages.
State: Needs Attention
Message: Armor has not received a log from the filebeat/winlogbeat service in the past 4 hours.
Description: If the logging services (filebeat/winlogbeat) fail to send a log within a 4-hour window, the state changes to "Needs Attention."
Actions for State Changes:
Logging Install: If the logging service is to be enabled, this action leads to the state being marked as "OK."
Logging Uninstall: If the logging service is to be disabled, this action leads to the state being marked as "N/A."
Turn VM Off: If the VM is turned off while in the "Needs Attention" state, the next step is to turn the VM back on.
Turn VM On: Once the VM is turned back on, the process reverts to checking the "State: OK."
Vulnerability Scanning
...
...
State: N/A
Message: Disabled - The customer opted out of this service.
Description: After installation, if the customer has opted out of the vulnerability scanning service, the state is marked as "N/A" with a message indicating the customer’s decision. Vulnerability scanning services are not installed in this case.
State: OK
Message: No message.
Description: If the Armor Agent and vulnerability scanning services (if opted in) are functioning correctly, the state is marked as "OK" with no additional messages.
State: Needs Attention
Message: Asset not found in last scan. Check the KB for remediation steps.
Description: If the vulnerability scanning service fails to detect the asset during the last scan, the state changes to "Needs Attention."
Actions for State Changes:
Vuln Install: If the vulnerability scanning service is to be enabled, this action leads to the state being marked as "OK."
Vuln Uninstall: If the vulnerability scanning service is to be disabled, this action leads to the state being marked as "N/A."
Turn VM Off: If the VM is turned off while in the "Needs Attention" state, the next step is to turn the VM back on.
Turn VM On: Once the VM is turned back on, the process reverts to checking the "State: OK."
Trend Sub-Agent
...
File Integrity Malware Service
State: N/A
Message: Malware Protection is not installed or configured.
Description: You will see "Malware Protection is not installed or configured" if FIM has not yet been installed or configured.
If FIM fails to complete the installation, a tooltip appears to redirect to the Armor KB page for installation instructions and troubleshooting.
State: OK
Message: No message.
Description: If the FIM (if opted in) sub-agent is functioning correctly, the state is marked as "OK" with no additional messages.
State: Needs Attention
Message: FIM has not provided a heartbeat in the past 4 hours.
Description: If the FIM service fails to send a heartbeat within a 4-hour window, the state changes to "Needs Attention."
Actions for State Changes:
Trend Install: If the Trend Micro service is to be enabled, this action leads to the state being marked as "OK."
Trend Uninstall: If the Trend Micro service is to be disabled, this action leads to the state being marked as "N/A."
FIM On: If FIM is turned on and functioning correctly, the state is marked as "OK."
FIM Off: If FIM is turned off, it leads to the state being marked as "N/A."
FIM On Failure: If there is a failure in turning on the FIM, it leads to "Bad Install Health."
Turn VM Off: If the VM is turned off while in the "Needs Attention" state, the next step is to turn the VM back on.
Turn VM On: Once the VM is turned back on, the process reverts to checking the "State: OK."
Bad Install Health: If the installation process encounters issues, it leads to a state marked as "Bad Install Health."
Notification Updates in the AMP Portal:
Before Change: Customers saw a notification in the AMP portal indicating "Disabled - Customer Opted Out" even if they had a failed Trend install or Trend failed to complete installation.
After Change:
The notification has been updated to reflect more specific statuses:
"Malware Protection is not installed or configured" if Trend has not yet been installed or configured.
"Trend has failed to complete the installation" with a tooltip redirecting to the Armor KB page for installation instructions and troubleshooting.
Any issue during installation that impacts the sub-agent's ability to register.
"Customer has disabled/opted out of the service."
If the customer has installed and uninstalled the sub-agent, the status will reflect the above changes accordingly.
Intrusion Detection Service
...
Malware Protection Service
...
VM Overview
...
After Armor Agent installation and before any sub-agent installation
...
Successful install of Trend, logging, and vulnerability scanning subagents
...
After turning AV and FIM on and IPS Detect
...
After AV, FIM, and IPS has been turned off
...
After uninstalling subagents
...
After reinstalling sub-agents
...
After 16 hours of turning off the VM
...
After more than 24 hours of turning off the VM
...
Module Command Failure
...
Successfully install of Trend and "FIM On" command fails
...
Successfully install of Trend and "AV On" command fails
...
Successfully install of Trend and "IPS Detect" command fails
...
| Table of Contents | ||||
|---|---|---|---|---|
|