Armor Knowledge Base

Home > Armor Anywhere - Product User Guide > Health Overview Dashboard (Armor Anywhere) > Protection Dashboard (Armor Anywhere)

Error rendering macro 'excerpt-include'

No link could be created for 'Protection dashboard (snippet)'.

Improve your Protection score

You can use the information below to troubleshoot the issues displayed in the Protection screen.

Armor recommends that you troubleshoot these issues to:

Improve your Protection scores
Improve your overall Health scores
Increase the overall security of your environment

Review each step to troubleshoot your problem. If the first step does not resolve the issue, then continue to the second step until the issue has been resolved. As always, you can send a support ticket.

Logging

Armor Service Issue Remediation

Logging

The filebeat logging agent is not installed.

Step 1: Verify the status of filebeat

	Description	Command	Extra information
Windows	Configurations are stored in the winlogbeat and filebeat directory within C:\.armor\opt\	`cat` `C:\.armor\opt\winlogbeat-5.2.0-windows-x86_64\winlogbeat.yml` `cat` `C:\.armor\opt\filebeat-5.2.0-windows-x86_64\filebeat.yml`	Windows uses both winlogbeat and filebeat. Commands should run in Powershell. To review additional configurations, certificates, and service information, review a server's directory: C:\.armor\opt\winlogbeat* C:\.armor\opt\filebeat*
	To verify the operation of the logging services, look for winlogbeat, filebeat	`gsv` `-displayname` `winlogbeat,filebeat`
	To verify the operation of the logging service processes, look for winlogbeat	`gps` `filebeat,winlogbeat`
	Confirm the configured log endpoint	`cat` `C:\.armor\opt\winlogbeat-5.2.0-windows-x86_64\winlogbeat.yml \| sls hosts`

Linux	Configurations are stored within /etc/filebeat/filebeat.yml	`cat` `/etc/filebeat/*.yml`
	Verify the operation of the filebeat service	`ps` `aux \|` `grep` `filebeat`
	Confirm the configured log endpoint	`grep` `-i hosts` `/etc/filebeat/filebeat.yml`
	Confirm the external_id	`grep` `-i external_id` `/etc/filebeat/filebeat.yml`
	Confirm the tenant ID	`grep` `-i tenant_id` `/etc/filebeat/filebeat.yml`

Step 2: Send a support ticket

Error rendering macro 'excerpt-include'

No link could be created for 'Create a support ticket (snippet)'.

Logging

The winlogbeat logging agent is not installed.

This section only applies to Windows users.

Step 1: Verify the status of winlogbeat

Description	Command	Extra information
Configurations are stored in the winlogbeat and filebeat directory within C:\.armor\opt\	`cat` `C:\.armor\opt\winlogbeat-5.2.0-windows-x86_64\winlogbeat.yml` `cat` `C:\.armor\opt\filebeat-5.2.0-windows-x86_64\filebeat.yml`	Windows uses both winlogbeat and filebeat. Commands should run in Powershell. To review additional configurations, certificates, and service information, review a server's directory: C:\.armor\opt\winlogbeat* C:\.armor\opt\filebeat*
To verify the operation of the logging services, look for winlogbeat, filebeat	`gsv` `-displayname` `winlogbeat,filebeat`
To verify the operation of the logging service processes, look for winlogbeat	`gps` `filebeat,winlogbeat`
Confirm the configured log endpoint	`cat` `C:\.armor\opt\winlogbeat-5.2.0-windows-x86_64\winlogbeat.yml \| sls hosts`

Step 2: Send a support ticket

Click the following link to open a support ticket in AMP: https://amp.armor.com/support/tickets/new

Logging

Armor has not received a log in the past 4 hours.

Step 1: Check logging services

	Description	Command	Extra information
Windows	Configurations are stored in the winlogbeat and filebeat directory within C:\.armor\opt\	`cat` `C:\.armor\opt\winlogbeat-5.2.0-windows-x86_64\winlogbeat.yml` `cat` `C:\.armor\opt\filebeat-5.2.0-windows-x86_64\filebeat.yml`	Windows uses both winlogbeat and filebeat. Commands should run in Powershell. To review additional configurations, certificates, and service information, review a server's directory: C:\.armor\opt\winlogbeat* C:\.armor\opt\filebeat*
	To verify the operation of the logging services, look for winlogbeat, filebeat	`gsv` `-displayname` `winlogbeat,filebeat`
	To verify the operation of the logging service processes, look for winlogbeat	`gps` `filebeat,winlogbeat`
	Confirm the configured log endpoint	`cat` `C:\.armor\opt\winlogbeat-5.2.0-windows-x86_64\winlogbeat.yml \| sls hosts`

Linux	Configurations are stored within /etc/filebeat/filebeat.yml	`cat` `/etc/filebeat/*.yml`
	Verify the operation of the filebeat service	`ps` `aux \|` `grep` `filebeat`
	Confirm the configured log endpoint	`grep` `-i hosts` `/etc/filebeat/filebeat.yml`
	Confirm the external_id	`grep` `-i external_id` `/etc/filebeat/filebeat.yml`
	Confirm the tenant ID	`grep` `-i tenant_id` `/etc/filebeat/filebeat.yml`

Step 2: Check connectivity

Port	Destination
515/tcp	46.88.106.196 (1a.log.armor.com) 146.88.144.196 (2a.log.armor.com)

Malware Protection

Armor Service Issue Remediation

Malware Protection

Malware Protection has not provided a heartbeat in the past 4 hours.

Step 1: Verify the status of the agent

	Description	Command
Windows	Verify that the service is running	gsv -displayname trend
Linux	Verify that the service is running	ps_axu \| grep ds_agent

Step 2: Check the connectivity of the agent

	Description	Command
Windows	Verify the URL endpoint epsec.armor.com	& "C:\Program Files\Trend Micro\Deep Security Agent\dsa_query.cmd" -c GetAgentStatus \| sls -pattern url
	Confirm connection to the URL	`new-object` `System.Net.Sockets.TcpClient('146.88.106.210', 443)`

Linux	Verify the URL endpoint epsec.armor.com	/opt/ds_agent/dsa_query -c GetAgentStatus \| grep AgentStatus.dsmUrl
	Confirm connection to the URL	`telnet` `146.88.106.210` `443`

Step 3: Manually heartbeat the agent

Description

Command

Windows

Verify a 200 response

PS C:\Users\Administrator> & "C:\Program Files\Trend Micro\Deep Security Agent\dsa_control.cmd" -m
HTTP Status: 200 - OK
Response:
Manager contact has been scheduled to occur in the next few seconds.

Linux

Verify a 200 response

/opt/ds_agent/dsa_control -m

Step 4: Send a support ticket

Click the following link to open a support ticket in AMP: https://amp.armor.com/support/tickets/new

Malware Protection

Malware Protection is not installed or configured.

Step 1: Verify the status of the agent

	Description	Command
Windows	Verify that the service is running	gsv -displayname trend
Linux	Verify that the service is running	ps_axu \| grep ds_agent

Step 2: Check the connectivity of the agent

	Description	Command
Windows	Verify the URL endpoint epsec.armor.com	& "C:\Program Files\Trend Micro\Deep Security Agent\dsa_query.cmd" -c GetAgentStatus \| sls -pattern url
	Confirm connection to the URL	`new-object` `System.Net.Sockets.TcpClient('146.88.106.210', 443)`

Linux	Verify the URL endpoint epsec.armor.com	/opt/ds_agent/dsa_query -c GetAgentStatus \| grep AgentStatus.dsmUrl
	Confirm connection to the URL	`telnet` `146.88.106.210` `443`

Step 3: Manually heartbeat the agent

Description

Command

Windows

Verify a 200 response

PS C:\Users\Administrator> & "C:\Program Files\Trend Micro\Deep Security Agent\dsa_control.cmd" -m
HTTP Status: 200 - OK
Response:
Manager contact has been scheduled to occur in the next few seconds.

Linux

Verify a 200 response

/opt/ds_agent/dsa_control -m

Step 4: Check the components for the agent

Windows	& "C:\Program Files\Trend Micro\Deep Security Agent\dsa_query.cmd" -c GetComponentInfo \| sls -pattern Component.AM
Linux	/opt/ds_agent/dsa_query -c GetComponentInfo \| grep Component.AM

Component.AM.mode describes if the Malware Protection module is installed.

Component.AM.rules is the number of rules derived from the Armor Deep Security Manager.

Step 5: Send a support ticket

Click the following link to open a support ticket in AMP: https://amp.armor.com/support/tickets/new

Malware Protection

Reboot is required for Malware Protection.

Step 1: Reboot your server

Step 2: Send a support ticket

Click the following link to open a support ticket in AMP: https://amp.armor.com/support/tickets/new

File Integrity Monitoring (FIM)

Armor Service Issue Remediation

File Integirty Monitoring (FIM)

FIM has not provided a heartbeat in the past 4 hours.

Step 1: Verify the status of the agent

	Description	Command
Windows	Verify that the service is running	gsv -displayname trend
Linux	Verify that the service is running	ps_axu \| grep ds_agent

Step 2: Check the connectivity of the agent

	Description	Command
Windows	Verify the URL endpoint epsec.armor.com	& "C:\Program Files\Trend Micro\Deep Security Agent\dsa_query.cmd" -c GetAgentStatus \| sls -pattern url
	Confirm connection to the URL	`new-object` `System.Net.Sockets.TcpClient('146.88.106.210', 443)`

Linux	Verify the URL endpoint epsec.armor.com	/opt/ds_agent/dsa_query -c GetAgentStatus \| grep AgentStatus.dsmUrl
	Confirm connection to the URL	`telnet` `146.88.106.210` `443`

Step 3: Manually heartbeat the agent

Description

Command

Windows

Verify a 200 response

PS C:\Users\Administrator> & "C:\Program Files\Trend Micro\Deep Security Agent\dsa_control.cmd" -m
HTTP Status: 200 - OK
Response:
Manager contact has been scheduled to occur in the next few seconds.

Linux

Verify a 200 response

/opt/ds_agent/dsa_control -m

Step 4: Send a support ticket

Click the following link to open a support ticket in AMP: https://amp.armor.com/support/tickets/new

File Integirty Monitoring (FIM)

FIM is installed but has not been configured.

Step 1: Verify the status of the agent

	Description	Command
Windows	Verify that the service is running	gsv -displayname trend
Linux	Verify that the service is running	ps_axu \| grep ds_agent

Step 2: Check the connectivity of the agent

	Description	Command
Windows	Verify the URL endpoint epsec.armor.com	& "C:\Program Files\Trend Micro\Deep Security Agent\dsa_query.cmd" -c GetAgentStatus \| sls -pattern url
	Confirm connection to the URL	`new-object` `System.Net.Sockets.TcpClient('146.88.106.210', 443)`

Linux	Verify the URL endpoint epsec.armor.com	/opt/ds_agent/dsa_query -c GetAgentStatus \| grep AgentStatus.dsmUrl
	Confirm connection to the URL	`telnet` `146.88.106.210` `443`

Step 3: Manually heartbeat the agent

Description

Command

Windows

Verify a 200 response

PS C:\Users\Administrator> & "C:\Program Files\Trend Micro\Deep Security Agent\dsa_control.cmd" -m
HTTP Status: 200 - OK
Response:
Manager contact has been scheduled to occur in the next few seconds.

Linux

Verify a 200 response

/opt/ds_agent/dsa_control -m

Step 4: Check the components for the agent

Windows	& "C:\Program Files\Trend Micro\Deep Security Agent\dsa_query.cmd" -c GetComponentInfo \| sls -pattern Component.IM
Linux	/opt/ds_agent/dsa_query -c GetComponentInfo \| grep Component.IM

Component.IM.mode describes if the FIM module is installed.

Component.IM.rules is the number of rules derived from the Armor Deep Security Manager.

Step 5: Send a support ticket

Click the following link to open a support ticket in AMP: https://amp.armor.com/support/tickets/new

File Integirty Monitoring (FIM)

FIM is not installed.

Step 1: Verify the status of the agent

	Description	Command
Windows	Verify that the service is running	gsv -displayname trend
Linux	Verify that the service is running	ps_axu \| grep ds_agent

Step 2: Check the connectivity of the agent

	Description	Command
Windows	Verify the URL endpoint epsec.armor.com	& "C:\Program Files\Trend Micro\Deep Security Agent\dsa_query.cmd" -c GetAgentStatus \| sls -pattern url
	Confirm connection to the URL	`new-object` `System.Net.Sockets.TcpClient('146.88.106.210', 443)`

Linux	Verify the URL endpoint epsec.armor.com	/opt/ds_agent/dsa_query -c GetAgentStatus \| grep AgentStatus.dsmUrl
	Confirm connection to the URL	`telnet` `146.88.106.210` `443`

Step 3: Manually heartbeat the agent

Description

Command

Windows

Verify a 200 response

PS C:\Users\Administrator> & "C:\Program Files\Trend Micro\Deep Security Agent\dsa_control.cmd" -m
HTTP Status: 200 - OK
Response:
Manager contact has been scheduled to occur in the next few seconds.

Linux

Verify a 200 response

/opt/ds_agent/dsa_control -m

Step 4: Send a support ticket

Click the following link to open a support ticket in AMP: https://amp.armor.com/support/tickets/new

Intrusion Detection System (IDS)

Armor Service Issue Remediation

IDS

IDS has not provided a heartbeat in the past 4 hours.

Step 1: Verify the status of the agent

	Description	Command
Windows	Verify that the service is running	gsv -displayname trend
Linux	Verify that the service is running	ps_axu \| grep ds_agent

Step 2: Check the connectivity of the agent

	Description	Command
Windows	Verify the URL endpoint epsec.armor.com	& "C:\Program Files\Trend Micro\Deep Security Agent\dsa_query.cmd" -c GetAgentStatus \| sls -pattern url
	Confirm connection to the URL	`new-object` `System.Net.Sockets.TcpClient('146.88.106.210', 443)`

Linux	Verify the URL endpoint epsec.armor.com	/opt/ds_agent/dsa_query -c GetAgentStatus \| grep AgentStatus.dsmUrl
	Confirm connection to the URL	`telnet` `146.88.106.210` `443`

Step 3: Manually heartbeat the agent

Description

Command

Windows

Verify a 200 response

PS C:\Users\Administrator> & "C:\Program Files\Trend Micro\Deep Security Agent\dsa_control.cmd" -m
HTTP Status: 200 - OK
Response:
Manager contact has been scheduled to occur in the next few seconds.

Linux

Verify a 200 response

/opt/ds_agent/dsa_control -m

Step 4: Send a support ticket

Click the following link to open a support ticket in AMP: https://amp.armor.com/support/tickets/new

IDS

IDS is installed but has not been configured.

Step 1: Verify the status of the agent

	Description	Command
Windows	Verify that the service is running	gsv -displayname trend
Linux	Verify that the service is running	ps_axu \| grep ds_agent

Step 2: Check the connectivity of the agent

	Description	Command
Windows	Verify the URL endpoint epsec.armor.com	& "C:\Program Files\Trend Micro\Deep Security Agent\dsa_query.cmd" -c GetAgentStatus \| sls -pattern url
	Confirm connection to the URL	`new-object` `System.Net.Sockets.TcpClient('146.88.106.210', 443)`

Linux	Verify the URL endpoint epsec.armor.com	/opt/ds_agent/dsa_query -c GetAgentStatus \| grep AgentStatus.dsmUrl
	Confirm connection to the URL	`telnet` `146.88.106.210` `443`

Step 3: Manually heartbeat the agent

Description

Command

Windows

Verify a 200 response

PS C:\Users\Administrator> & "C:\Program Files\Trend Micro\Deep Security Agent\dsa_control.cmd" -m
HTTP Status: 200 - OK
Response:
Manager contact has been scheduled to occur in the next few seconds.

Linux

Verify a 200 response

/opt/ds_agent/dsa_control -m

Step 4: Send a support ticket

Click the following link to open a support ticket in AMP: https://amp.armor.com/support/tickets/new

IDS

IDS is not installed or enabled.

Step 1: Verify the status of the agent

	Description	Command
Windows	Verify that the service is running	gsv -displayname trend
Linux	Verify that the service is running	ps_axu \| grep ds_agent

Step 2: Check the connectivity of the agent

	Description	Command
Windows	Verify the URL endpoint epsec.armor.com	& "C:\Program Files\Trend Micro\Deep Security Agent\dsa_query.cmd" -c GetAgentStatus \| sls -pattern url
	Confirm connection to the URL	`new-object` `System.Net.Sockets.TcpClient('146.88.106.210', 443)`

Linux	Verify the URL endpoint epsec.armor.com	/opt/ds_agent/dsa_query -c GetAgentStatus \| grep AgentStatus.dsmUrl
	Confirm connection to the URL	`telnet` `146.88.106.210` `443`

Step 3: Manually heartbeat the agent

Windows

PS C:\Users\Administrator> & "C:\Program Files\Trend Micro\Deep Security Agent\dsa_control.cmd" -m
HTTP Status: 200 - OK
Response:
Manager contact has been scheduled to occur in the next few seconds.

Linux

/opt/ds_agent/dsa_control -m

Step 4: Send a support ticket

Click the following link to open a support ticket in AMP: https://amp.armor.com/support/tickets/new

Vulnerability Scanning

Armor Service

Issue

Remediation

Vulnerability Scanning

If IR Agent is not installed

Step 1: Verify the status of the agent

Windows	IR Agent files are located within C:\Program Files\Rapid7 The IR Agent service name is "Rapid7 Insight Agent"
Linux	IR Agent files are located within /opt/rapid7/ir_agent IR Agent logs are located within /opt/rapid7/ir_agent/agent.log* Upgrade logs are one level above, within /opt/rapid7/upgrade*

Step 2: Check connectivity of the agent

Port	Destination
443/tcp (IR Agent)	endpoint.ingress.rapid7.com * (United States) eu.endpoint.ingress.rapid7.com * (Europe, Middle East, Africa)

* The agent will perform a lookup to the applicable DNS entry, which may resolve to one of multiple Amazon Web Services based subnets. As a result, if your firewall does not support outbound filtering by domain name, then you may need to open all outbound traffic to 443/tcp to accommodate this service.

Step 3: Send a support ticket

Click the following link to open a support ticket in AMP: https://amp.armor.com/support/tickets/new

Vulnerability Scanning

The Vulnerability Scanning agent did not run during the most recent scan.

Step 1: Verify the status of the agent

Windows	IR Agent files are located within C:\Program Files\Rapid7 The IR Agent service name is "Rapid7 Insight Agent"
Linux	IR Agent files are located within /opt/rapid7/ir_agent IR Agent logs are located within /opt/rapid7/ir_agent/agent.log* Upgrade logs are one level above, within /opt/rapid7/upgrade*

Step 2: Check connectivity of the agent

Port	Destination
443/tcp (IR Agent)	endpoint.ingress.rapid7.com * (United States) eu.endpoint.ingress.rapid7.com * (Europe, Middle East, Africa)

* The agent will perform a lookup to the applicable DNS entry, which may resolve to one of multiple Amazon Web Services based subnets. As a result, if your firewall does not support outbound filtering by domain name, then you may need to open all outbound traffic to 443/tcp to accommodate this service.

Step 3: Send a support ticket

Click the following link to open a support ticket in AMP: https://amp.armor.com/support/tickets/new

Space shortcuts

Page tree

Theme Press Tour Guide

com.brikit.tour.guide.title

EXTRA LAYER

NOTES

Not the Real Navigation

Dolor Sit Amet

Internal

Customer

Armor Knowledge Base

Improve your Protection score

Logging

Malware Protection

File Integrity Monitoring (FIM)

Intrusion Detection System (IDS)

Vulnerability Scanning

Armor Defense Inc. Copyright © 2020. All rights reserved.

Space shortcuts

Page tree

Theme Press Tour Guide

com.brikit.tour.guide.title

EXTRA LAYER

NOTES

Not the Real Navigation

Dolor Sit Amet

Internal

Customer

Protection Dashboard (Armor Anywhere)

Search

Armor Knowledge Base

Improve your Protection score

Logging

Malware Protection

File Integrity Monitoring (FIM)

Intrusion Detection System (IDS)

Vulnerability Scanning

Armor Defense Inc. Copyright © 2020. All rights reserved.