Toolbox

Overview

The Toolbox is a self service tool accessing a combination of services that allows customers to remotely manage services on one or multiple Virtual Machines on an account. Below are how to steps for using the toolbox as well as descriptions of the services you can manage with the toolbox.

Users looking to deploy services at scale can use the Toolbox to schedule tasks for a fleet of assets in their environment.

How to Schedule a Task

Users can access the Schedule Task Screen from the Toolbox in either Nexus or the legacy Armor Management Portal (AMP). Once a task is scheduled, the page will display all pending and completed tasks. The Schedule Task button is available at the top of the screen. For more details about the Toolbox screen, [click here].

• In Nexus, the Toolbox screen can be found under the Security Posture section, within the Endpoint category.

• In the Armor Management Portal (AMP), the Toolbox screen is located under the Infrastructure section.

1. Navigate to the Toolbox screen.

2. Click Schedule Task.

3. Click the Product drop-down and select the desired Armor Security Service.

4. Click the Operation drop-down and select the desired operation.

5. If necessary, enter additional configuration parameters in the Additional Configuration text box.

6. Enter a task name in the Task Name field.

7. Click Schedule Future Date to select the task date.

   1. Unless configured otherwise, all tasks will run at the next Agent Heartbeat (every 15 minutes).

8. Click Select VMs button.

9. Select the appropriate Virtual Machines using the check boxes.

10. Click Select VMs.

11. Select VMs.

12. Confirm the selected VMs by clicking on Select VMs.

13. Click Schedule Task.

Asynchronous Security API Calls

Users may want to configure security services asynchronously so that security services can be activated without immediately triggering feedback. For some commands, users can use the flag async=true to queue these features as needed. The command async=true works for both Windows and Linux and should be placed at the end of the command line as shows in the example below:

Windows: C:\.armor\opt\armor.exe av on async=true
Linux: /opt/armor/armor av on async=true

The async flag can also be configured in the Armor Toolbox.

Review Task Results

Users can check the status and results of scheduled tasks in two ways:

Option 1: From the Toolbox Screen

• Navigate to the Toolbox screen.

• Locate the task by the name it was created under.

• The screen will display both pending and completed tasks.

Option 2: From a Specific Virtual Machine

• Go to the Virtual Machines screen:

  • This is located under Infrastructure > Compute.

• Select the desired VM to view its details.

• Navigate to the CLI Results tab to see the output of tasks executed on that VM.

Security Services

Below are the Armor Security Services you can manage from the Armor Toolbox. Several operations can be run asynchronously to prevent immediate API feedback. For more information on the Async Flag, please see the documentation above.

Trend

Trend is the parent sub-agent for all Trend modules, including Malware Protection, File Integrity Monitoring, and Intrusion Prevention.

One of the features available in Agent 3.0 is Recommendation scans. Recommendation scans provide a good starting point for establishing a list of rules that you should implement. During a recommendation scan, the Armor Agent scans the operating system for installed applications, the Windows registry, open ports, and more.

In order to use Malware Protection, File Integrity Monitoring, and Intrusion Prevention, please install the Trend Sub-Agent. To take advantage of Recommendation scans, turn on Ongoing Recommendation scans in the Toolbox.

.Malware Protection

The Armor Malware Protection service protects your Virtual Machines against file-based threats such as malware, viruses, and more.

To use this feature, select the Malware Protection product in the Toolbox and choose the "on" operation.

File Integrity Monitoring

The Armor File Integrity Monitoring service detects changes to files and critical system areas (e.g. Windows registry) that could indicate suspicious activity. If you have enabled Recommendation scans (Trend sub-agent), you can run Recommendation scans with FIM to identify a list of rules that should be applied based on the configuration of your Virtual Machine. You can also choose to have the recommended rules automatically applied to your machine.

To use this feature, select the FIM product in the Toolbox and choose the "on" operation. To use this feature with Recommendation scans, select the FIM product in the Toolbox and choose the "auto-apply-recommendations-on" operation.

.Intrusion Prevention System

The Armor Intrusion Prevention System service detects or prevents known and zero-day vulnerabilities (e.g. SQL injections attacks, cross-site scripting attacks, etc). Customers can use IPS in prevent or detect mode, depending on whether you want traffic to be blocked or not. If you have enabled Recommendation scans (Trend sub-agent), you can run Recommendation scans with IPS to identify a list of rules that should be applied based on the configuration of your Virtual Machine. You can also choose to have the recommended rules automatically applied to your machine.

To use this feature, select the IPS product in the Toolbox and choose the "prevent" or "detect" operation. To use this feature with Recommendation scans, select the IPS product (prevent or detect mode) in the Toolbox and choose the "auto-apply-recommendations-on" operation.

.Vulnerability Management

Armor's Vulnerability Scanning service detects OS and application vulnerabilities present in your environment.

To use this feature, select the Vulnerability Management product in the Toolbox and choose the "on" operation.

.

Logging

The Armor Logging service ships OS logs to Armor for correlation and analysis.

To use this feature, select the Logging product in the Toolbox and choose the "on" operation.

By default, the Armor Agent collects the following logs for 30 days:

Log Relay

To use this feature, select the Log Relay product in the Toolbox and choose the "install" operation.

Additional Services

Tags

Armor's Tagging feature allows users to add metadata tags to their logs. Users can search for these tags via the API, or through Nexus or the legacy Armor Management Portal (AMP) on the Virtual Machines screen.To use this feature, select the Tags product in the Toolbox and choose the "create tags" operation. In the Additional Configuration text box, enter a key value pair (e.g. key=pair). You can enter more than one tag using a comma as separator.

Communication Check

The communication-check operation is used to validate outbound connectivity from a customer’s VM to specified hosts and ports. This operation helps ensure that services such as Trend Vision One are reachable and functioning correctly.

armor communication-check  <host1[:port1]>,<host2[:port2]>,...

Examples:

Windows: C:\.armor\opt\armor.exe agent communication-check agents.deepsecurity.trendmicro.com,us-west.epsec.secure-prod.services:4120,workload.us-1.cloudone.trendmicro.com
Linux: /opt/armor/armor agent communication-check agents.deepsecurity.trendmicro.com,us-west.epsec.secure-prod.services:4120,workload.us-1.cloudone.trendmicro.com

Toolbox example:

SSL Check

This command will check servers used by the agent for connectivity. SSL-check command will check all services regardless of if a particular service is installed on them or not. This feature is primarily for debugging and informational purposes. Command is valid for both Windows and Linux operating systems.

Remediate

This command will perform on-demand remediation of security subagent services by checking their installation and runtime status, restarting them if necessary, and verifying connectivity to their respective servers. It also validates TLS certificates and automatically renews them if found invalid—updating the system’s trust store as needed. Each action is logged for visibility and traceability. This ensures critical agent services are functional and securely connected, reducing downtime and manual troubleshooting efforts.

Sysmon

Configuring Apache services uses the Command Line Interface (CLI) feature. For more information, see Security Service CLI Commands.

The following arguments to install and uninstall Sysmon services.

The following arguments are possible parameters for the Logging CLI feature.

In this Article:

Armor Security Services

The tables within the sections below provide context to the Product and Operation fields used in the Schedule Task form.