View Arctic Wolf Agent health

  1. Sign in to the Arctic Wolf Unified Portal.
  2. In the navigation menu, click Data Collection > Agents.
The Arctic Wolf Agent health overview summarizes the health of your Agent deployments based on these health categories:
  • Needs Investigation — Indicates this Agent status:
    • Contained — The Arctic Wolf Agent has successfully contained the host device. Contact your CST at security@arcticwolf.com for assistance.
  • Disconnected — Indicates this Agent status:
    • Offline > 72hrs — The Arctic Wolf Agent has been offline for longer than 72 hours. If the host machine is expected to be online, this could indicate a connectivity problem.
  • Needs Attention — Indicates one of these Agent statuses:
    • Degraded — The Arctic Wolf Agent is online but not collecting logs. Make sure that your firewall is accepting connections over port 443 and 1514. An Agent with a Degraded health status displays these messages in View Arctic Wolf Agent details:
      • Health Insights Missing — Make sure that your firewall is configured to allow outbound traffic from this endpoint to Arctic Wolf. Check the Allowlist Requirements page for port numbers. If this problem continues, contact your Concierge Team.
      • Wazuh Connection Failure — Your firewall might not be configured to allow outbound traffic from this endpoint to Arctic Wolf. Check the Allowlist Requirements page for port numbers. If this problem continues, contact your Concierge Team.
      • Wazuh Not Installed — Wazuh might not be installed correctly. Contact your Concierge Team for assistance.
      • Wazuh Reconnection Failure — The Wazuh service was restarted but could not connect. Contact your Concierge Team for assistance.
      • Wazuh Service Failure — The Wazuh service failed to start. Contact your Concierge Team for assistance.

      These messages include a Last Log Connection timestamp, which is the last time Agent successfully connected to Arctic Wolf.

  • Healthy — Indicates one of these Agent statuses:
    • Online — The Arctic Wolf Agent has connected within the past 20 minutes and is providing insights to your CST.
    • Offline < 72hrs — The Arctic Wolf Agent has been offline for longer than 20 minutes. This is common for a workstation that is not currently in use.