Protection Dashboard (Armor Anywhere)

...

Armor Service Issue Remediation

IDS

IDS has not provided a heartbeat in the past 4 hours.

Expand

title	Step 1: Verify the status of the agent

	Description	Command
Windows	Verify that the service is running	gsv -displayname trend
Linux	Verify that the service is running	ps_axu \| grep ds_agent

Excerpt

hidden	true

Expand

title	Step 1: Verify the status of the agent

Windows

Code Block

& "C:\Program Files\Trend Micro\Deep Security Agent\dsa_query.cmd" -c GetComponentInfo | sls FWDPI
 
Component.FWDPI.dpiRules: 164
Component.FWDPI.driverState: 3
Component.FWDPI.firewallMode: on-tap
Component.FWDPI.mode: on-tap

Linux

Code Block

[root@ip-172-31-43-60 ~]# /opt/ds_agent/dsa_query -c GetComponentInfo | grep FWDPI
2016-11-18 01:15:47.000000: [Debug/6] | Starting thread 'CScriptThread' with stack size of 1048576 | /build/workspace/Sustain/9.6SP1HF/Build_DSA_96SP1HF_Amazon64/src/dsa/core/threadMgr/Runnable.cpp:587:start | FA6:7F7767397880:*unknown*
Component.FWDPI.dpiRules: 145
Component.FWDPI.driverState: 3
Component.FWDPI.firewallMode: on-tap
Component.FWDPI.mode: on-tap

Expand

title	Step 2: Check the connectivity of the agent

	Description	Command
Windows	Verify the URL endpoint epsec.armor.com	& "C:\Program Files\Trend Micro\Deep Security Agent\dsa_query.cmd" -c GetAgentStatus \| sls -pattern url
	Confirm connection to the URL	`new-object` `System.Net.Sockets.TcpClient('146.88.106.210', 443)`

Linux	Verify the URL endpoint epsec.armor.com	/opt/ds_agent/dsa_query -c GetAgentStatus \| grep AgentStatus.dsmUrl
	Confirm connection to the URL	`telnet` `146.88.106.210` `443`

Expand

title	Step 3: Manually heartbeat the agent

Description

Command

Windows

Verify a 200 response

Code Block
PS C:\Users\Administrator> & "C:\Program Files\Trend Micro\Deep Security Agent\dsa_control.cmd" -m HTTP Status: 200 - OK Response: Manager contact has been scheduled to occur in the next few seconds.

Linux

Verify a 200 response

Code Block
/opt/ds_agent/dsa_control -m

IDS

IDS is installed but has not been configured.

Expand

title	Step 1: Verify the status of the agent

	Description	Command
Windows	Verify that the service is running	gsv -displayname trend
Linux	Verify that the service is running	ps_axu \| grep ds_agent

Expand

title	Step 2: Check the connectivity of the agent

	Description	Command
Windows	Verify the URL endpoint epsec.armor.com	& "C:\Program Files\Trend Micro\Deep Security Agent\dsa_query.cmd" -c GetAgentStatus \| sls -pattern url
	Confirm connection to the URL	`new-object` `System.Net.Sockets.TcpClient('146.88.106.210', 443)`

Linux	Verify the URL endpoint epsec.armor.com	/opt/ds_agent/dsa_query -c GetAgentStatus \| grep AgentStatus.dsmUrl
	Confirm connection to the URL	`telnet` `146.88.106.210` `443`

Expand

title	Step 3: Manually heartbeat the agent

Description

Command

Windows

Verify a 200 response

Code Block
PS C:\Users\Administrator> & "C:\Program Files\Trend Micro\Deep Security Agent\dsa_control.cmd" -m HTTP Status: 200 - OK Response: Manager contact has been scheduled to occur in the next few seconds.

Linux

Verify a 200 response

Code Block
/opt/ds_agent/dsa_control -m

IDS

IDS is not installed or enabled.

Expand

title	Step 1: Verify the status of the agent

	Description	Command
Windows	Verify that the service is running	gsv -displayname trend
Linux	Verify that the service is running	ps_axu \| grep ds_agent

Expand

title	Step 2: Check the connectivity of the agent

	Description	Command
Windows	Verify the URL endpoint epsec.armor.com	& "C:\Program Files\Trend Micro\Deep Security Agent\dsa_query.cmd" -c GetAgentStatus \| sls -pattern url
	Confirm connection to the URL	`new-object` `System.Net.Sockets.TcpClient('146.88.106.210', 443)`

Linux	Verify the URL endpoint epsec.armor.com	/opt/ds_agent/dsa_query -c GetAgentStatus \| grep AgentStatus.dsmUrl
	Confirm connection to the URL	`telnet` `146.88.106.210` `443`

Expand

title	Step 3: Manually heartbeat the agent

Windows

Code Block
PS C:\Users\Administrator> & "C:\Program Files\Trend Micro\Deep Security Agent\dsa_control.cmd" -m HTTP Status: 200 - OK Response: Manager contact has been scheduled to occur in the next few seconds.

Linux

Code Block
/opt/ds_agent/dsa_control -m

Note

If you are still unable to troubleshoot the issue, then please open a support ticket.

To learn how to send a support ticket, see Support Tickets.

...

Vulnerability Scanning

Armor Service

Issue

Remediation

Vulnerability Scanning

If IR Agent is not installed

Expand

title	Step 1: Verify the status of the agent

Windows	IR Agent files are located within C:\Program Files\Rapid7 The IR Agent service name is "Rapid7 Insight Agent"
Linux	IR Agent files are located within /opt/rapid7/ir_agent IR Agent logs are located within /opt/rapid7/ir_agent/agent.log* Upgrade logs are one level above, within /opt/rapid7/upgrade*

Expand

title	Step 2: Check connectivity of the agent

Port	Destination
443/tcp (IR Agent)	endpoint.ingress.rapid7.com * (United States) eu.endpoint.ingress.rapid7.com * (Europe, Middle East, Africa)

Note
* The agent will perform a lookup to the applicable DNS entry, which may resolve to one of multiple Amazon Web Services based subnets. As a result, if your firewall does not support outbound filtering by domain name, then you may need to open all outbound traffic to 443/tcp to accommodate this service.

Vulnerability Scanning

The Vulnerability Scanning agent did not run during the most recent scan.

Expand

title	Step 1: Verify the status of the agent

Windows	IR Agent files are located within C:\Program Files\Rapid7 The IR Agent service name is "Rapid7 Insight Agent"
Linux	IR Agent files are located within /opt/rapid7/ir_agent IR Agent logs are located within /opt/rapid7/ir_agent/agent.log* Upgrade logs are one level above, within /opt/rapid7/upgrade*

Expand

title	Step 2: Check connectivity of the agent

Port	Destination
443/tcp (IR Agent)	endpoint.ingress.rapid7.com * (United States) eu.endpoint.ingress.rapid7.com * (Europe, Middle East, Africa)

Note
* The agent will perform a lookup to the applicable DNS entry, which may resolve to one of multiple Amazon Web Services based subnets. As a result, if your firewall does not support outbound filtering by domain name, then you may need to open all outbound traffic to 443/tcp to accommodate this service.

...

Space shortcuts

Page tree

Theme Press Tour Guide

com.brikit.tour.guide.title

EXTRA LAYER

NOTES

Not the Real Navigation

Dolor Sit Amet

Internal

Customer

Versions Compared

Old Version 14

New Version 15

Key

Vulnerability Scanning

Armor Defense Inc. Copyright © 2020. All rights reserved.