Armor Agent & Subagent Statuses

Overview

Armor Agent and sub-agent health status change during the various steps of installation & uninstallation. These statuses are reflected in the following diagrams:

Armor Agent

State: OK
- Message: N/A
- Description: After installation, if the Armor Agent is functioning correctly and sending regular heartbeats, the state is marked as "OK."
State: Needs Attention
- Message: The Armor Agent has not sent a heartbeat in the past 4 hours.
- Description: If the Armor Agent fails to send a heartbeat within a 4-hour window, the state changes to "Needs Attention."
Action for State: Needs Attention
- Turn VM Off: If the VM is turned off, the process should turn it back on.
- Turn VM On: Once the VM is turned on, the process reverts to checking the "State: OK."

This process ensures continuous monitoring and timely attention if the Armor Agent fails to send a heartbeat, indicating potential issues with the VM or the agent itself.

File Logging/Windows Event Logging

State: N/A
- Message: Disabled - The customer opted out of this service.
- Description: After installation, if the customer has opted out of the logging service, the state is marked as "N/A" with a message indicating the customer’s decision. Logging services are not installed in this case.
State: OK
- Message: No message.
- Description: If the Armor Agent and logging services (if opted in) are functioning correctly, the state is marked as "OK" with no additional messages.
State: Needs Attention
- Message: Armor has not received a log from the filebeat/winlogbeat service in the past 4 hours.
- Description: If the logging services (filebeat/winlogbeat) fail to send a log within a 4-hour window, the state changes to "Needs Attention."
Actions for State Changes:
- Logging Install: If the logging service is to be enabled, this action leads to the state being marked as "OK."
- Logging Uninstall: If the logging service is to be disabled, this action leads to the state being marked as "N/A."
- Turn VM Off: If the VM is turned off while in the "Needs Attention" state, the next step is to turn the VM back on.
- Turn VM On: Once the VM is turned back on, the process reverts to checking the "State: OK."

Vulnerability Scanning

State: N/A
- Message: Disabled - The customer opted out of this service.
- Description: After installation, if the customer has opted out of the vulnerability scanning service, the state is marked as "N/A" with a message indicating the customer’s decision. Vulnerability scanning services are not installed in this case.
State: OK
- Message: No message.
- Description: If the Armor Agent and vulnerability scanning services (if opted in) are functioning correctly, the state is marked as "OK" with no additional messages.
State: Needs Attention
- Message: Asset not found in last scan. Check the KB for remediation steps.
- Description: If the vulnerability scanning service fails to detect the asset during the last scan, the state changes to "Needs Attention."
Actions for State Changes:
- Vuln Install: If the vulnerability scanning service is to be enabled, this action leads to the state being marked as "OK."
- Vuln Uninstall: If the vulnerability scanning service is to be disabled, this action leads to the state being marked as "N/A."
- Turn VM Off: If the VM is turned off while in the "Needs Attention" state, the next step is to turn the VM back on.
- Turn VM On: Once the VM is turned back on, the process reverts to checking the "State: OK."

Trend Sub-Agent

File Integrity Malware Service

State: N/A
- Message: Malware Protection is not installed or configured.
- Description: You will see "Malware Protection is not installed or configured" if FIM has not yet been installed or configured.
  - If FIM fails to complete the installation, a tooltip appears to redirect to the Armor KB page for installation instructions and troubleshooting.
State: OK
- Message: No message.
- Description: If the FIM (if opted in) sub-agent is functioning correctly, the state is marked as "OK" with no additional messages.
State: Needs Attention
- Message: FIM has not provided a heartbeat in the past 4 hours.
  - Description: If the FIM service fails to send a heartbeat within a 4-hour window, the state changes to "Needs Attention."
Actions for State Changes:
- Trend Install: If the Trend Micro service is to be enabled, this action leads to the state being marked as "OK."
- Trend Uninstall: If the Trend Micro service is to be disabled, this action leads to the state being marked as "N/A."
- FIM On: If FIM is turned on and functioning correctly, the state is marked as "OK."
- FIM Off: If FIM is turned off, it leads to the state being marked as "N/A."
- FIM On Failure: If there is a failure in turning on the FIM, it leads to "Bad Install Health."
- Turn VM Off: If the VM is turned off while in the "Needs Attention" state, the next step is to turn the VM back on.
- Turn VM On: Once the VM is turned back on, the process reverts to checking the "State: OK."
Bad Install Health: If the installation process encounters issues, it leads to a state marked as "Bad Install Health."

Notification Updates in the AMP Portal:

Before Change: Customers saw a notification in the AMP portal indicating "Disabled - Customer Opted Out" even if they had a failed Trend install or Trend failed to complete installation.
After Change:
- The notification has been updated to reflect more specific statuses:
  - "Malware Protection is not installed or configured" if Trend has not yet been installed or configured.
  - "Trend has failed to complete the installation" with a tooltip redirecting to the Armor KB page for installation instructions and troubleshooting.
  - Any issue during installation that impacts the sub-agent's ability to register.
  - "Customer has disabled/opted out of the service."
- If the customer has installed and uninstalled the sub-agent, the status will reflect the above changes accordingly.

Intrusion Detection Service