View Arctic Wolf Agent health
- Arctic Wolf Unified Portal にサインインします。
- ナビゲーションメニューで、
［データ収集］ > ［エージェント］をクリックします。
The Arctic Wolf エージェント health overview summarizes the health of your エージェント deployments based on these health categories:
- Needs Investigation — Indicates this エージェント status:
- Contained — The Arctic Wolf エージェント has successfully contained the host device. Contact your CST at security@arcticwolf.com for assistance.
- Disconnected — Indicates this エージェント status:
- Offline > 72hrs — The Arctic Wolf エージェント has been offline for longer than 72 hours. If the host machine is expected to be online, this could indicate a connectivity problem.
- Needs Attention — Indicates one of these エージェント statuses:
- Degraded — The Arctic Wolf エージェント is online but not collecting logs. Make sure that your firewall is accepting connections over port 443 and 1514. An エージェント with a Degraded health status displays these messages in View Arctic Wolf Agent details:
- Health Insights Missing — Make sure that your firewall is configured to allow outbound traffic from this endpoint to Arctic Wolf. Check the Allowlist Requirements page for port numbers. If this problem continues, contact your Concierge Team.
- Wazuh Connection Failure — Your firewall might not be configured to allow outbound traffic from this endpoint to Arctic Wolf. Check the Allowlist Requirements page for port numbers. If this problem continues, contact your Concierge Team.
- Wazuh Not Installed — Wazuh might not be installed correctly. Contact your Concierge Team for assistance.
- Wazuh Reconnection Failure — The Wazuh service was restarted but could not connect. Contact your Concierge Team for assistance.
- Wazuh Service Failure — The Wazuh service failed to start. Contact your Concierge Team for assistance.
These messages include a Last Log Connection timestamp, which is the last time エージェント successfully connected to Arctic Wolf.
- Degraded — The Arctic Wolf エージェント is online but not collecting logs. Make sure that your firewall is accepting connections over port 443 and 1514. An エージェント with a Degraded health status displays these messages in View Arctic Wolf Agent details:
- Healthy — Indicates one of these エージェント statuses:
- Online — The Arctic Wolf エージェント has connected within the past 20 minutes and is providing insights to your CST.
- Offline < 72hrs — The Arctic Wolf エージェント has been offline for longer than 20 minutes. This is common for a workstation that is not currently in use.