Verifying Agent Streaming

If you have access to Helix, you can perform an index search to qualify the following:

deviceid – The device ID of your Endpoint Security server
agentid – The ID of the agent under question. (alternatively, you can use the hostname property)

To verify the health of the agent, use the telemetry available in Sysinfo. Sysinfo is accessible through the Host Management Module, or through the Endpoint Security REST API. Refer to the Lighthouse section of the API-Docs module > Host Information .

For Sysinfo, the following fields are useful:

IOCStreamingStatus – Should be ‘running’; otherwise you may not have streaming enabled in the policy for the agent.
operational – Should be ‘1’, otherwise the value within operationalNotes should be reviewed to reveal underlying issues.
intelLastUpdateValid – Should be ‘1’; then take note of the value of intelLastUpdated to verify that the agent has a version of the streaming rule content. intelActiveVersion is also a good indicator here as this value can be correlated to the version of the most recent update.
tokenManagerConnectionStatus – Should be ‘Normal’; as the module will attempt connection upon startup. Otherwise, you will need to run agent diagnostics to pull the logs to determine the details for why it is not normal.
hitCount – Will be a non-zero number when the module has received notification of hits against the streaming rule content. These hits will be buffered before forwarding to Helix.
helixConnectionStatus – Should be ‘Normal’. If not, verify the helixID. If this is incorrect you will need to verify your Helix configuration on your Endpoint Security Server. If you make adjustments there, you must restart the IOC Streaming server module to pick up those changes. When you restart the HX module you must re-enable IOC Streaming within the agent policy. If the ID is correct, you will need to run agent diagnostics to pull the logs to determine error details.
helixTrendMessagesDelivered / Skipped – The delivered messages should be increasing once the connection status is ‘Normal’. Messages will be skipped if the destination becomes disconnected or unresponsive and we exceed the extent of the local buffer.

Note

Ensure that you restart the IOC Streaming module when you make updates to the Helix destination configuration on your Endpoint Security server for the module to pick up the updates. When restarting the IOC Streaming module, you must revisit the policies that was enabled IOC Streaming and re-enable IOC Streaming within those policies.