Verifying installation

After you install and enable the AMSI module, check for the existence of module files under C:\ProgramData\Trellix\xagt\exts\amsi\sandbox and C:\ProgramData\Trellix\xagt\exts\plugin\amsi.

The working status of the plug-in can be verified on the Endpoint Security server using the API /hx/api/v3/hosts/<agent_id>/sysinfo call to review the system information (SysInfo) received from the endpoint agent. You should see the following fields in the SysInfo JSON data.

    "AmsiStatus":"running",
     "Amsi”: {
        "version":"1.2.0",
        "plugin-supported":"true",
        "provider-registered":"true"
        "intel-version": "464-lb.101",
        "rules-version": "2021.01.20",
        "intel-timestamp": "2021-02-17T19:04:16Z",
        "intel-received-timestamp": "2021-03-02T16:00:48Z",
        …
    }

Field Name	Description
`plugin-supported`	AMSI is only supported on Windows 10 or Windows Server 2016 and above. When this is set to "false", the OS does not support the AMSI feature.
`provider-registered`	Indicates whether the Trellix AMSI module is registered with Windows OS.
`Intel-version`	Intel version as seen in the Security Endpoint controller.
`Rules-version`	AMSI rules version found in a subpackage in the Intel package.
`Intel-timestamp`	Intel timestamp seen in the Security Endpoint controller.
`Intel-received-timestamp`	Intel timestamp when the endpoint receives AMSI rules.

The AMSI agent module creates log files in c:\Windows\Temp. Depending on the scenario, the following files are created:

amsi_install.log
amsi_uninstall.log
amsi_preupgrade.log
amsi_upgrade.log

Check agent logs for additional messages related to the plug-in installation.

The log file for the server module installation is stored on the server in /var/log/supervisor/amsi-server_<version>_<unique_id>.log.