Armor Agent & Subagent Statuses

Owned by Aaron Gabriel (Deactivated)
Last updated: 26 July 2024 by Catie G.
3 min read

Overview

Armor Agent and sub-agent health status change during the various steps of installation & uninstallation. These statuses are reflected in the following diagrams:

Armor Agent

  1. State: OK

    • Message: N/A

    • Description: After installation, if the Armor Agent is functioning correctly and sending regular heartbeats, the state is marked as "OK."

  2. State: Needs Attention

    • Message: The Armor Agent has not sent a heartbeat in the past 4 hours.

    • Description: If the Armor Agent fails to send a heartbeat within a 4-hour window, the state changes to "Needs Attention."

  3. Action for State: Needs Attention

    • Turn VM Off: If the VM is turned off, the process should turn it back on.

    • Turn VM On: Once the VM is turned on, the process reverts to checking the "State: OK."

This process ensures continuous monitoring and timely attention if the Armor Agent fails to send a heartbeat, indicating potential issues with the VM or the agent itself.

File Logging/Windows Event Logging



  1. State: N/A

    • Message: Disabled - The customer opted out of this service.

    • Description: After installation, if the customer has opted out of the logging service, the state is marked as "N/A" with a message indicating the customer’s decision. Logging services are not installed in this case.

  2. State: OK

    • Message: No message.

    • Description: If the Armor Agent and logging services (if opted in) are functioning correctly, the state is marked as "OK" with no additional messages.

  3. State: Needs Attention

    • Message: Armor has not received a log from the filebeat/winlogbeat service in the past 4 hours.

    • Description: If the logging services (filebeat/winlogbeat) fail to send a log within a 4-hour window, the state changes to "Needs Attention."

  4. Actions for State Changes:

    • Logging Install: If the logging service is to be enabled, this action leads to the state being marked as "OK."

    • Logging Uninstall: If the logging service is to be disabled, this action leads to the state being marked as "N/A."

    • Turn VM Off: If the VM is turned off while in the "Needs Attention" state, the next step is to turn the VM back on.

    • Turn VM On: Once the VM is turned back on, the process reverts to checking the "State: OK."

Vulnerability Scanning





  • State: N/A

    • Message: Disabled - The customer opted out of this service.

    • Description: After installation, if the customer has opted out of the vulnerability scanning service, the state is marked as "N/A" with a message indicating the customer’s decision. Vulnerability scanning services are not installed in this case.

  • State: OK

    • Message: No message.

    • Description: If the Armor Agent and vulnerability scanning services (if opted in) are functioning correctly, the state is marked as "OK" with no additional messages.

  • State: Needs Attention

    • Message: Asset not found in last scan. Check the KB for remediation steps.

    • Description: If the vulnerability scanning service fails to detect the asset during the last scan, the state changes to "Needs Attention."

  • Actions for State Changes:

    • Vuln Install: If the vulnerability scanning service is to be enabled, this action leads to the state being marked as "OK."

    • Vuln Uninstall: If the vulnerability scanning service is to be disabled, this action leads to the state being marked as "N/A."

    • Turn VM Off: If the VM is turned off while in the "Needs Attention" state, the next step is to turn the VM back on.

    • Turn VM On: Once the VM is turned back on, the process reverts to checking the "State: OK."

Trend Sub-Agent

File Integrity Malware Service

  1. State: N/A

    • Message: Malware Protection is not installed or configured.

    • Description: You will see "Malware Protection is not installed or configured" if FIM has not yet been installed or configured.

      • If FIM fails to complete the installation, a tooltip appears to redirect to the Armor KB page for installation instructions and troubleshooting.

  2. State: OK

    • Message: No message.

    • Description: If the FIM (if opted in) sub-agent is functioning correctly, the state is marked as "OK" with no additional messages.

  3. State: Needs Attention

    • Message: FIM has not provided a heartbeat in the past 4 hours.

      • Description: If the FIM service fails to send a heartbeat within a 4-hour window, the state changes to "Needs Attention."

  4. Actions for State Changes:

    • Trend Install: If the Trend Micro service is to be enabled, this action leads to the state being marked as "OK."

    • Trend Uninstall: If the Trend Micro service is to be disabled, this action leads to the state being marked as "N/A."

    • FIM On: If FIM is turned on and functioning correctly, the state is marked as "OK."

    • FIM Off: If FIM is turned off, it leads to the state being marked as "N/A."

    • FIM On Failure: If there is a failure in turning on the FIM, it leads to "Bad Install Health."

    • Turn VM Off: If the VM is turned off while in the "Needs Attention" state, the next step is to turn the VM back on.

    • Turn VM On: Once the VM is turned back on, the process reverts to checking the "State: OK."

  5. Bad Install Health: If the installation process encounters issues, it leads to a state marked as "Bad Install Health."

Notification Updates in the AMP Portal:

  • Before Change: Customers saw a notification in the AMP portal indicating "Disabled - Customer Opted Out" even if they had a failed Trend install or Trend failed to complete installation.

  • After Change:

    • The notification has been updated to reflect more specific statuses:

      • "Malware Protection is not installed or configured" if Trend has not yet been installed or configured.

      • "Trend has failed to complete the installation" with a tooltip redirecting to the Armor KB page for installation instructions and troubleshooting.

      • Any issue during installation that impacts the sub-agent's ability to register.

      • "Customer has disabled/opted out of the service."

    • If the customer has installed and uninstalled the sub-agent, the status will reflect the above changes accordingly.

Intrusion Detection Service


Malware Protection Service

VM Overview

After Armor Agent installation and before any sub-agent installation



Successful install of Trend, logging, and vulnerability scanning subagents

After turning AV and FIM on and IPS Detect


After AV, FIM, and IPS has been turned off


After uninstalling subagents

After reinstalling sub-agents

After 16 hours of turning off the VM


After more than 24 hours of turning off the VM

Module Command Failure

Successfully install of Trend and "FIM On" command fails

Successfully install of Trend and "AV On" command fails


Successfully install of Trend and "IPS Detect" command fails