Focus

Traps Endpoint Security Manager Administrator's Guide

Monitor - Agent

Table of Contents

Monitor - Agent

The following table displays the agent logs you can forward to an external logging platform or email.

Event Name	Description
Agent Access Violation	An agent reported an access violation. CEF—AccessViolation LEEF—AccessViolation Syslog—AccessViolation Email—AccessViolation
Agent Heartbeat	A heartbeat was received from the agent. CEF—Heartbeat LEEF—Heartbeat Syslog—Heartbeat Email—Heartbeat
Agent Service Start	The agent service was started on the endpoint. CEF—ServiceAlive LEEF—ServiceAlive Syslog—ServiceAlive Email—ServiceAlive
Agent Service Stopped	The agent service was stopped on the endpoint. CEF—ServiceStopped LEEF—ServiceStopped Syslog—ServiceStopped Email—ServiceStopped
Agent Shutdown	The endpoint was shut down. CEF—SystemShutdown LEEF—SystemShutdown Syslog—SystemShutdown Email—SystemShutdown
Agent Service Start Failed	The agent service failed to start on the endpoint. CEF—ServiceStartFailed LEEF—ServiceStartFailed Syslog—ServiceStartFailed Email—ServiceStartFailed
Agent Service Warning	The agent service reported a warning. CEF—ServiceWarning LEEF—ServiceWarning Syslog—ServiceWarning Email—ServiceWarning
Process Crash	A process has crashed on the endpoint. CEF—ProcessCrashed LEEF—ProcessCrashed Syslog—ProcessCrashed Email—ProcessCrashed
Agent Process Injection Timeout	The agent exceeded the permissible amount of time to inject into a process. CEF—ProcessInjectionTimedOut LEEF—ProcessInjectionTimedOut Syslog—ProcessInjectionTimedOut Email—ProcessInjectionTimedOut
Agent Reporting Service Start Failed	The agent reporting service failed to start. CEF—ReportingServiceStartFailed LEEF—ReportingServiceStartFailed Syslog—ReportingServiceStartFailed Email—ReportingServiceStartFailed
Agent File Upload Failed	The agent failed to upload a file. CEF—FileUploadFailure LEEF—FileUploadFailure Syslog—FileUploadFailure Email—FileUploadFailure
Agent Installed to System	Traps was installed on an endpoint. CEF—ClientInstall LEEF—ClientInstall Syslog—ClientInstall Email—ClientInstall
Agent Uninstalled from System	Traps was uninstalled from an endpoint. CEF—ClientUninstall LEEF—ClientUninstall Syslog—ClientUninstall Email—ClientUninstall
Agent Upgraded	Traps was upgraded on an endpoint. CEF—ClientUpgrade LEEF—ClientUpgrade Syslog—ClientUpgrade Email—ClientUpgrade
Agent Status Change	The agent status has changed. CEF—TrapsServiceStatusChange LEEF—TrapsServiceStatusChange Syslog—TrapsServiceStatusChange Email—TrapsServiceStatusChange
Agent Policy Change	The agent policy has changed. CEF—AgentPolicyChange LEEF—AgentPolicyChange Syslog—AgentPolicyChange Email—AgentPolicyChange
Local Analysis Feature Extraction Failed	The file that local analysis tried to examine was corrupt and could not be examined using local analysis. When this occurs, Traps identifies the file as malware until it receives a verdict (either from WildFire or the administrative hash control policy). CEF—LocalAnalysisFeatureExtractionFailed LEEF—LocalAnalysisFeatureExtractionFailed Syslog—LocalAnalysisFeatureExtractionFailed Email—LocalAnalysisFeatureExtractionFailed
Local Analysis Model Unavailable	The local analysis model was missing on the endpoint and was therefore disabled. CEF—LocalAnalysisModelUnavailable LEEF—LocalAnalysisModelUnavailable Syslog—LocalAnalysisModelUnavailable Email—LocalAnalysisModelUnavailable
Local Analysis Module Succeeded	The local analysis model successfully analyzed an unknown executable file and issued a verdict. CEF—LocalAnalysisModuleSucceeded LEEF—LocalAnalysisModuleSucceeded Syslog—LocalAnalysisModuleSucceeded Email—LocalAnalysisModuleSucceeded
Local Analysis Module Failed	The local analysis model failed to analyze an unknown executable file and issue a verdict. CEF—LocalAnalysisModuleFailed LEEF—LocalAnalysisModuleFailed Syslog—LocalAnalysisModuleFailed Email—LocalAnalysisModuleFailed
Trusted Signer Changed	The local decision of a trusted signer on the agent has changed. This can be due a change in the local certificate store on the endpoint, a content update containing changes to the trusted signer list, or a manual update to the trusted signers list. CEF—PublisherChanged LEEF—PublisherChanged Syslog—PublisherChanged Email—PublisherChanged
Agent Content Update	The agent received a new content update version. CEF—AgentContentUpdate LEEF—AgentContentUpdate Syslog—AgentContentUpdate Email—AgentContentUpdate
Quarantine Quota Exceeded	The storage quota for quarantined files on the endpoint has been exceeded. CEF—QuarantineQuotaExceeded LEEF—QuarantineQuotaExceeded Syslog—QuarantineQuotaExceeded Email—QuarantineQuotaExceeded
Agent Authentication Failed	The agent failed to authenticate with the ESM Server. CEF—AgentAuthenticationFailed LEEF—AgentAuthenticationFailed Syslog—AgentAuthenticationFailed Email—AgentAuthenticationFailed
Agent Policy Update Failed	The agent failed to update the local policy. CEF—AgentPolicyChangesFailed LEEF—AgentPolicyChangesFailed Syslog—AgentPolicyChangesFailed Email—AgentPolicyChangesFailed
Agent Registration Conflict	An agent that has already registered with the ESM Server has tried to re-register but lacks valid authentication identification. This could indicate: A duplicate machine name exists on the network (for Traps agents running pre-4.0.2 versions). When this occurs, ensure the machine name is unique or upgrade the agent to Traps 4.0.2 or a later release to ensure the agent receives a unique ID. A malicious component is attempting to manipulate the endpoint protection policy. When this occurs, verify the validity of the agent and, if needed, remediate the component. Formats: CEF—RegistrationConflict LEEF—RegistrationConflict Syslog—RegistrationConflict Email—RegistrationConflict
ESM Cert Validation Warning	The agent could not authenticate with the ESM Server using the provided client certificate. CEF—EsmCertValidationWarning LEEF—EsmCertValidationWarning Syslog—EsmCertValidationWarning Email—EsmCertValidationWarning
Agent Migrated to Cloud	Future use

Policies - Hash Control

Monitor ESM