{"type":"doc","content":[{"type":"heading","attrs":{"level":4},"content":[{"text":"Topics Discussed","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"maxLevel":{"value":"3"},"minLevel":{"value":"3"},"outline":{"value":"false"},"type":{"value":"list"},"printable":{"value":"false"}},"macroMetadata":{"macroId":{"value":"1be101e0-3aa5-446d-a1cc-a643e6a0537c"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"92934ede-a31e-44f2-ab91-c1e226c41e6f"}},{"type":"paragraph","content":[{"text":"You can use the information below to troubleshoot the issues displayed in the ","type":"text"},{"text":"Protection","type":"text","marks":[{"type":"strong"}]},{"text":" screen.","type":"text"}]},{"type":"paragraph","content":[{"text":"Armor recommends that you troubleshoot these issues to:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Improve your Protection scores","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Improve your overall Health scores","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Increase the overall security of your environment","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Review each step to troubleshoot your problem. If the first step does not resolve the issue, then continue to the second step until the issue has been resolved. As always, you can send a support ticket.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Logging","type":"text","marks":[{"type":"strong"}]}]},{"type":"rule"},{"type":"table","attrs":{"layout":"default","width":1797.0,"localId":"6c88f9eb-82d0-456a-92f2-88782d4b727f"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[203.0]},"content":[{"type":"paragraph","content":[{"text":"Armor Service","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[323.0]},"content":[{"type":"paragraph","content":[{"text":"Issue","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[1271.0]},"content":[{"type":"paragraph","content":[{"text":"Remediation","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[203.0]},"content":[{"type":"paragraph","content":[{"text":"Logging","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[323.0]},"content":[{"type":"paragraph","content":[{"text":"The filebeat logging agent is not installed.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1271.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"nestedExpand","attrs":{"title":"Step 1: Verify the status of filebeat"},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"paragraph","content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.migration","extensionKey":"__confluenceADFMigrationUnsupportedContentInternalExtension__","text":"","parameters":{"cxhtml":"

	Description	Command	Extra information
Windows	Configurations are stored in the winlogbeat and filebeat directory within C:\\.armor\\opt\\	`cat` `C:\\.armor\\opt\\winlogbeat-5.2.0-windows-x86_64\\winlogbeat.yml` `cat` `C:\\.armor\\opt\\filebeat-5.2.0-windows-x86_64\\filebeat.yml`	Windows uses both winlogbeat and filebeat. Commands should run in Powershell. To review additional configurations, certificates, and service information, review a server's directory: C:\\.armor\\opt\\winlogbeat* C:\\.armor\\opt\\filebeat*
	To verify the operation of the logging services, look for winlogbeat, filebeat	`gsv` `-displayname` `winlogbeat,filebeat`
	To verify the operation of the logging service processes, look for winlogbeat	`gps` `filebeat,winlogbeat`
	Confirm the configured log endpoint	`cat` `C:\\.armor\\opt\\winlogbeat-5.2.0-windows-x86_64\\winlogbeat.yml \| sls hosts`

Linux	Configurations are stored within /etc/filebeat/filebeat.yml	`cat` `/etc/filebeat/*.yml`
	Verify the operation of the filebeat service	`ps` `aux \|` `grep` `filebeat`
	Confirm the configured log endpoint	`grep` `-i hosts` `/etc/filebeat/filebeat.yml`
	Confirm the external_id	`grep` `-i external_id` `/etc/filebeat/filebeat.yml`
	Confirm the tenant ID	`grep` `-i tenant_id` `/etc/filebeat/filebeat.yml`

","block-inline":true,"nestedContent":{"type":"doc","content":[{"type":"table","content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Command","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Extra information","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Windows","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Configurations are stored in the winlogbeat and filebeat directory within ","type":"text"},{"text":"C:\\.armor\\opt\\","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"cat","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"},{"text":"C:\\.armor\\opt\\winlogbeat-5.2.0","type":"text","marks":[{"type":"code"}]},{"text":"-windows","type":"text","marks":[{"type":"code"}]},{"text":"-x86_64\\winlogbeat.yml","type":"text","marks":[{"type":"code"}]},{"type":"hardBreak"},{"text":"cat","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"},{"text":"C:\\.armor\\opt\\filebeat-5.2.0","type":"text","marks":[{"type":"code"}]},{"text":"-windows","type":"text","marks":[{"type":"code"}]},{"text":"-x86_64\\filebeat.yml","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Windows uses both winlogbeat and filebeat.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Commands should run in Powershell.","type":"text"},{"type":"hardBreak"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"To review additional configurations, certificates, and service information, review a server's directory:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph"},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"C:\\.armor\\opt\\winlogbeat*","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"C:\\.armor\\opt\\filebeat*","type":"text"}]}]}]}]}]}]}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"To verify the operation of the logging services, look for ","type":"text"},{"text":"winlogbeat","type":"text","marks":[{"type":"strong"}]},{"text":", ","type":"text"},{"text":"filebeat","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"gsv","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"},{"text":"-displayname","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"},{"text":"winlogbeat,filebeat","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"To verify the operation of the logging service processes, look for ","type":"text"},{"text":"winlogbeat","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"gps","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"},{"text":"filebeat,winlogbeat","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Confirm the configured log endpoint","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"cat","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"},{"text":"C:\\.armor\\opt\\winlogbeat-5.2.0-windows-x86_64\\winlogbeat.yml | sls hosts","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Linux","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Configurations are stored within ","type":"text"},{"text":"/etc/filebeat/filebeat.yml","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"cat","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"},{"text":"/etc/filebeat/","type":"text","marks":[{"type":"code"}]},{"text":"*.yml","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Verify the operation of the filebeat service","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"ps","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"},{"text":"aux | ","type":"text","marks":[{"type":"code"}]},{"text":"grep","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"},{"text":"filebeat","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Confirm the configured log endpoint","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"grep","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"},{"text":"-i hosts ","type":"text","marks":[{"type":"code"}]},{"text":"/etc/filebeat/filebeat","type":"text","marks":[{"type":"code"}]},{"text":".yml","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Confirm the external_id","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"grep","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"},{"text":"-i external_id ","type":"text","marks":[{"type":"code"}]},{"text":"/etc/filebeat/filebeat","type":"text","marks":[{"type":"code"}]},{"text":".yml","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Confirm the tenant ID","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"grep","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"},{"text":"-i tenant_id ","type":"text","marks":[{"type":"code"}]},{"text":"/etc/filebeat/filebeat","type":"text","marks":[{"type":"code"}]},{"text":".yml","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]}]}],"version":1}}}}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"nestedExpand","attrs":{"title":"Step 2: Send a support ticket"},"content":[{"type":"paragraph","content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"excerpt-include","parameters":{"macroParams":{"":{"value":"Armor Support"},"name":{"value":"Create Support Ticket"},"nopanel":{"value":"true"}},"macroMetadata":{"macroId":{"value":"b2ee5cf0-1873-4062-8bc8-f5533b763da6"},"schemaVersion":{"value":"1"},"title":"Insert excerpt"}},"localId":"ffd7f540-d019-4280-ab0a-cff22814cf86"}}]}]},{"type":"paragraph"}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[203.0]},"content":[{"type":"paragraph","content":[{"text":"Logging","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[323.0]},"content":[{"type":"paragraph","content":[{"text":"The winlogbeat logging agent is not installed.","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"This section only applies to Windows users.","type":"text"}]}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1271.0]},"content":[{"type":"paragraph"},{"type":"nestedExpand","attrs":{"title":"Step 1: Verify the status of winlogbeat"},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"paragraph","content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.migration","extensionKey":"__confluenceADFMigrationUnsupportedContentInternalExtension__","text":"","parameters":{"cxhtml":"

Description	Command	Extra information
Configurations are stored in the winlogbeat and filebeat directory within C:\\.armor\\opt\\	`cat` `C:\\.armor\\opt\\winlogbeat-5.2.0-windows-x86_64\\winlogbeat.yml` `cat` `C:\\.armor\\opt\\filebeat-5.2.0-windows-x86_64\\filebeat.yml`	Windows uses both winlogbeat and filebeat. Commands should run in Powershell. To review additional configurations, certificates, and service information, review a server's directory: C:\\.armor\\opt\\winlogbeat* C:\\.armor\\opt\\filebeat*
To verify the operation of the logging services, look for winlogbeat, filebeat	`gsv` `-displayname` `winlogbeat,filebeat`
To verify the operation of the logging service processes, look for winlogbeat	`gps` `filebeat,winlogbeat`
Confirm the configured log endpoint	`cat` `C:\\.armor\\opt\\winlogbeat-5.2.0-windows-x86_64\\winlogbeat.yml \| sls hosts`

	Description	Command	Extra information
Windows	Configurations are stored in the winlogbeat and filebeat directory within C:\\.armor\\opt\\	`cat` `C:\\.armor\\opt\\winlogbeat-5.2.0-windows-x86_64\\winlogbeat.yml` `cat` `C:\\.armor\\opt\\filebeat-5.2.0-windows-x86_64\\filebeat.yml`	Windows uses both winlogbeat and filebeat. Commands should run in Powershell. To review additional configurations, certificates, and service information, review a server's directory: C:\\.armor\\opt\\winlogbeat* C:\\.armor\\opt\\filebeat*
	To verify the operation of the logging services, look for winlogbeat, filebeat	`gsv` `-displayname` `winlogbeat,filebeat`
	To verify the operation of the logging service processes, look for winlogbeat	`gps` `filebeat,winlogbeat`
	Confirm the configured log endpoint	`cat` `C:\\.armor\\opt\\winlogbeat-5.2.0-windows-x86_64\\winlogbeat.yml \| sls hosts`

Linux	Configurations are stored within /etc/filebeat/filebeat.yml	`cat` `/etc/filebeat/*.yml`
	Verify the operation of the filebeat service	`ps` `aux \|` `grep` `filebeat`
	Confirm the configured log endpoint	`grep` `-i hosts` `/etc/filebeat/filebeat.yml`
	Confirm the external_id	`grep` `-i external_id` `/etc/filebeat/filebeat.yml`
	Confirm the tenant ID	`grep` `-i tenant_id` `/etc/filebeat/filebeat.yml`

","block-inline":true,"nestedContent":{"type":"doc","content":[{"type":"table","content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Command","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Extra information","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Windows","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Configurations are stored in the winlogbeat and filebeat directory within ","type":"text"},{"text":"C:\\.armor\\opt\\","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"cat","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"},{"text":"C:\\.armor\\opt\\winlogbeat-5.2.0","type":"text","marks":[{"type":"code"}]},{"text":"-windows","type":"text","marks":[{"type":"code"}]},{"text":"-x86_64\\winlogbeat.yml","type":"text","marks":[{"type":"code"}]},{"type":"hardBreak"},{"text":"cat","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"},{"text":"C:\\.armor\\opt\\filebeat-5.2.0","type":"text","marks":[{"type":"code"}]},{"text":"-windows","type":"text","marks":[{"type":"code"}]},{"text":"-x86_64\\filebeat.yml","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Windows uses both winlogbeat and filebeat.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Commands should run in Powershell.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"To review additional configurations, certificates, and service information, review a server's directory:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph"},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"C:\\.armor\\opt\\winlogbeat*","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"C:\\.armor\\opt\\filebeat*","type":"text"}]}]}]}]}]}]}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"To verify the operation of the logging services, look for ","type":"text"},{"text":"winlogbeat","type":"text","marks":[{"type":"strong"}]},{"text":", ","type":"text"},{"text":"filebeat","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"gsv","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"},{"text":"-displayname","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"},{"text":"winlogbeat,filebeat","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"To verify the operation of the logging service processes, look for ","type":"text"},{"text":"winlogbeat","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"gps","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"},{"text":"filebeat,winlogbeat","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Confirm the configured log endpoint","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"cat","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"},{"text":"C:\\.armor\\opt\\winlogbeat-5.2.0-windows-x86_64\\winlogbeat.yml | sls hosts","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Linux","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Configurations are stored within ","type":"text"},{"text":"/etc/filebeat/filebeat.yml","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"cat","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"},{"text":"/etc/filebeat/","type":"text","marks":[{"type":"code"}]},{"text":"*.yml","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Verify the operation of the filebeat service","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"ps","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"},{"text":"aux | ","type":"text","marks":[{"type":"code"}]},{"text":"grep","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"},{"text":"filebeat","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Confirm the configured log endpoint","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"grep","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"},{"text":"-i hosts ","type":"text","marks":[{"type":"code"}]},{"text":"/etc/filebeat/filebeat","type":"text","marks":[{"type":"code"}]},{"text":".yml","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Confirm the external_id","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"grep","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"},{"text":"-i external_id ","type":"text","marks":[{"type":"code"}]},{"text":"/etc/filebeat/filebeat","type":"text","marks":[{"type":"code"}]},{"text":".yml","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Confirm the tenant ID","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"grep","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"},{"text":"-i tenant_id ","type":"text","marks":[{"type":"code"}]},{"text":"/etc/filebeat/filebeat","type":"text","marks":[{"type":"code"}]},{"text":".yml","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]}]}],"version":1}}}}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"nestedExpand","attrs":{"title":"Step 2: Check connectivity "},"content":[{"type":"paragraph"},{"type":"paragraph","content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.migration","extensionKey":"__confluenceADFMigrationUnsupportedContentInternalExtension__","text":"","parameters":{"cxhtml":"

Port	Destination
515/tcp	46.88.106.196 (1a.log.armor.com) 146.88.144.196 (2a.log.armor.com)

	Description	Command
Windows	Verify that the service is running	gsv -displayname trend
Linux	Verify that the service is running	ps -axu \| grep ds_agent

	Description	Command
Windows	Verify the URL endpoint epsec.armor.com	& "C:\\Program Files\\Trend Micro\\Deep Security Agent\\dsa_query.cmd" -c GetAgentStatus \| sls -pattern url
	Confirm connection to the URL	`new-object` `System.Net.Sockets.TcpClient('146.88.106.210', 443)`

Linux	Verify the URL endpoint epsec.armor.com	/opt/ds_agent/dsa_query -c GetAgentStatus \| grep AgentStatus.dsmUrl
	Confirm connection to the URL	`telnet` `146.88.106.210` `443`

	Description	Command
Windows	Verify a 200 response	& \"C:\\Program Files\\Trend Micro\\Deep Security Agent\\dsa_control.cmd\" -m\nHTTP Status: 200 - OK\nResponse:\nManager contact has been scheduled to occur in the next few seconds.]]>
Linux	Verify a 200 response

	Description	Command
Windows	Verify that the service is running	gsv -displayname trend
Linux	Verify that the service is running	ps -axu \| grep ds_agent

	Description	Command
Windows	Verify the URL endpoint epsec.armor.com	& "C:\\Program Files\\Trend Micro\\Deep Security Agent\\dsa_query.cmd" -c GetAgentStatus \| sls -pattern url
	Confirm connection to the URL	`new-object` `System.Net.Sockets.TcpClient('146.88.106.210', 443)`

Linux	Verify the URL endpoint epsec.armor.com	/opt/ds_agent/dsa_query -c GetAgentStatus \| grep AgentStatus.dsmUrl
	Confirm connection to the URL	`telnet` `146.88.106.210` `443`

	Description	Command
Windows	Verify a 200 response	& \"C:\\Program Files\\Trend Micro\\Deep Security Agent\\dsa_control.cmd\" -m\nHTTP Status: 200 - OK\nResponse:\nManager contact has been scheduled to occur in the next few seconds.]]>
Linux	Verify a 200 response

Windows
Linux

Windows

Linux

Component.AM.mode describes if the Malware Protection module is installed.

Component.AM.rules is the number of rules derived from the Armor Deep Security Manager.

","block-inline":true,"nestedContent":{"type":"doc","content":[{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Component.AM.mode","type":"text","marks":[{"type":"strong"}]},{"text":" describes if the Malware Protection module is installed.","type":"text"}]},{"type":"paragraph","content":[{"text":"Component.AM.rules","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text","marks":[{"type":"em"},{"type":"strong"}]},{"text":"is the number of rules derived from the Armor Deep Security Manager.","type":"text"}]}]}],"version":1}}}}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"nestedExpand","attrs":{"title":"Step 5: Send a support ticket"},"content":[{"type":"paragraph","content":[{"text":"Click the following link to open a support ticket in AMP: ","type":"text"},{"text":"https://amp.armor.com/support/tickets/new","type":"text","marks":[{"type":"link","attrs":{"href":"https://amp.armor.com/support/tickets/new"}}]}]}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[210.0]},"content":[{"type":"paragraph","content":[{"text":"Malware Protection","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[316.0]},"content":[{"type":"paragraph","content":[{"text":"Reboot is required for Malware Protection.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1271.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"nestedExpand","attrs":{"title":"Step 1: Reboot your server"},"content":[{"type":"paragraph","content":[{"text":"Step 1: Reboot your server","type":"text"}]}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"nestedExpand","attrs":{"title":"Step 2: Send a support ticket"},"content":[{"type":"paragraph","content":[{"text":"Click the following link to open a support ticket in AMP: ","type":"text"},{"text":"https://amp.armor.com/support/tickets/new","type":"text","marks":[{"type":"link","attrs":{"href":"https://amp.armor.com/support/tickets/new"}}]}]}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"File Integrity Monitoring (FIM)","type":"text","marks":[{"type":"strong"}]}]},{"type":"rule"},{"type":"table","attrs":{"layout":"default","width":1797.0,"localId":"20407de5-f8b7-4f36-a831-33c7b9ab8511"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[178.0]},"content":[{"type":"paragraph","content":[{"text":"Armor Service","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[352.0]},"content":[{"type":"paragraph","content":[{"text":"Issue","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[1267.0]},"content":[{"type":"paragraph","content":[{"text":"Remediation","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[178.0]},"content":[{"type":"paragraph","content":[{"text":"File Integrity Monitoring (FIM)","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[352.0]},"content":[{"type":"paragraph","content":[{"text":"FIM has not provided a heartbeat in the past 4 hours.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1267.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"nestedExpand","attrs":{"title":"Step 1: Verify the status of the agent"},"content":[{"type":"paragraph"},{"type":"paragraph","content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.migration","extensionKey":"__confluenceADFMigrationUnsupportedContentInternalExtension__","text":"","parameters":{"cxhtml":"

	Description	Command
Windows	Verify that the service is running	gsv -displayname trend
Linux	Verify that the service is running	ps -axu \| grep ds_agent

	Description	Command
Windows	Verify the URL endpoint epsec.armor.com	& "C:\\Program Files\\Trend Micro\\Deep Security Agent\\dsa_query.cmd" -c GetAgentStatus \| sls -pattern url
	Confirm connection to the URL	`new-object` `System.Net.Sockets.TcpClient('146.88.106.210', 443)`

Linux	Verify the URL endpoint epsec.armor.com	/opt/ds_agent/dsa_query -c GetAgentStatus \| grep AgentStatus.dsmUrl
	Confirm connection to the URL	`telnet` `146.88.106.210` `443`

	Description	Command
Windows	Verify a 200 response	& \"C:\\Program Files\\Trend Micro\\Deep Security Agent\\dsa_control.cmd\" -m\nHTTP Status: 200 - OK\nResponse:\nManager contact has been scheduled to occur in the next few seconds.]]>
Linux	Verify a 200 response

	Description	Command
Windows	Verify that the service is running	gsv -displayname trend
Linux	Verify that the service is running	ps -axu \| grep ds_agent

	Description	Command
Windows	Verify the URL endpoint epsec.armor.com	& "C:\\Program Files\\Trend Micro\\Deep Security Agent\\dsa_query.cmd" -c GetAgentStatus \| sls -pattern url
	Confirm connection to the URL	`new-object` `System.Net.Sockets.TcpClient('146.88.106.210', 443)`

Linux	Verify the URL endpoint epsec.armor.com	/opt/ds_agent/dsa_query -c GetAgentStatus \| grep AgentStatus.dsmUrl
	Confirm connection to the URL	`telnet` `146.88.106.210` `443`

	Description	Command
Windows	Verify a 200 response	& \"C:\\Program Files\\Trend Micro\\Deep Security Agent\\dsa_control.cmd\" -m\nHTTP Status: 200 - OK\nResponse:\nManager contact has been scheduled to occur in the next few seconds.]]>
Linux	Verify a 200 response

Windows
Linux

Windows

Linux

Component.IM.mode describes if the FIM module is installed.

Component.IM.rules is the number of rules derived from the Armor Deep Security Manager.

	Description	Command
Windows	Verify that the service is running	gsv -displayname trend
Linux	Verify that the service is running	ps -axu \| grep ds_agent

	Description	Command
Windows	Verify the URL endpoint epsec.armor.com	& "C:\\Program Files\\Trend Micro\\Deep Security Agent\\dsa_query.cmd" -c GetAgentStatus \| sls -pattern url
	Confirm connection to the URL	`new-object` `System.Net.Sockets.TcpClient('146.88.106.210', 443)`

Linux	Verify the URL endpoint epsec.armor.com	/opt/ds_agent/dsa_query -c GetAgentStatus \| grep AgentStatus.dsmUrl
	Confirm connection to the URL	`telnet` `146.88.106.210` `443`

	Description	Command
Windows	Verify a 200 response	& \"C:\\Program Files\\Trend Micro\\Deep Security Agent\\dsa_control.cmd\" -m\nHTTP Status: 200 - OK\nResponse:\nManager contact has been scheduled to occur in the next few seconds.]]>
Linux	Verify a 200 response

	Description	Command
Windows	Verify that the service is running	gsv -displayname trend
Linux	Verify that the service is running	ps -axu \| grep ds_agent

	Description	Command
Windows	Verify the URL endpoint epsec.armor.com	& "C:\\Program Files\\Trend Micro\\Deep Security Agent\\dsa_query.cmd" -c GetAgentStatus \| sls -pattern url
	Confirm connection to the URL	`new-object` `System.Net.Sockets.TcpClient('146.88.106.210', 443)`

Linux	Verify the URL endpoint epsec.armor.com	/opt/ds_agent/dsa_query -c GetAgentStatus \| grep AgentStatus.dsmUrl
	Confirm connection to the URL	`telnet` `146.88.106.210` `443`

	Description	Command
Windows	Verify a 200 response	& \"C:\\Program Files\\Trend Micro\\Deep Security Agent\\dsa_control.cmd\" -m\nHTTP Status: 200 - OK\nResponse:\nManager contact has been scheduled to occur in the next few seconds.]]>
Linux	Verify a 200 response

	Description	Command
Windows	Verify that the service is running	gsv -displayname trend
Linux	Verify that the service is running	ps -axu \| grep ds_agent

	Description	Command
Windows	Verify the URL endpoint epsec.armor.com	& "C:\\Program Files\\Trend Micro\\Deep Security Agent\\dsa_query.cmd" -c GetAgentStatus \| sls -pattern url
	Confirm connection to the URL	`new-object` `System.Net.Sockets.TcpClient('146.88.106.210', 443)`

Linux	Verify the URL endpoint epsec.armor.com	/opt/ds_agent/dsa_query -c GetAgentStatus \| grep AgentStatus.dsmUrl
	Confirm connection to the URL	`telnet` `146.88.106.210` `443`

	Description	Command
Windows	Verify a 200 response	& \"C:\\Program Files\\Trend Micro\\Deep Security Agent\\dsa_control.cmd\" -m\nHTTP Status: 200 - OK\nResponse:\nManager contact has been scheduled to occur in the next few seconds.]]>
Linux	Verify a 200 response

	Description	Command
Windows	Verify that the service is running	gsv -displayname trend
Linux	Verify that the service is running	ps -axu \| grep ds_agent

	Description	Command
Windows	Verify the URL endpoint epsec.armor.com	& "C:\\Program Files\\Trend Micro\\Deep Security Agent\\dsa_query.cmd" -c GetAgentStatus \| sls -pattern url
	Confirm connection to the URL	`new-object` `System.Net.Sockets.TcpClient('146.88.106.210', 443)`

Linux	Verify the URL endpoint epsec.armor.com	/opt/ds_agent/dsa_query -c GetAgentStatus \| grep AgentStatus.dsmUrl
	Confirm connection to the URL	`telnet` `146.88.106.210` `443`

Windows	& \"C:\\Program Files\\Trend Micro\\Deep Security Agent\\dsa_control.cmd\" -m\nHTTP Status: 200 - OK\nResponse:\nManager contact has been scheduled to occur in the next few seconds.]]>
Linux

Browser not supported