Monitoring, reporting, and troubleshooting
This domain tests whether you can read Harmony Endpoint health correctly, produce useful reports, and troubleshoot from the endpoint outward instead of guessing. Questions often hinge on the difference between agent connectivity, policy installation status, and blade enablement.
Monitoring views
- Endpoint status shows connected or disconnected, last communication, installed client version, and policy version.
- Blade status shows whether protections are enabled and updating; a blade can be enabled in policy but not yet installed on the endpoint.
- Alerts and audit logs show detections, administrative changes, and policy installations.
Reporting
Security reports summarize detections and top affected endpoints; compliance reports show policy and encryption or media-control status; audit reports track administrative activity. Schedule and export reports for stakeholders, and forward logs to a SIEM where required. Match the report to the audience rather than exporting raw logs for every request.
Troubleshooting flow
Scope the problem: one endpoint, one site, or all endpoints. Check the agent service, console status, policy installation result, connectivity to management or Infinity Portal over HTTPS 443, proxy configuration, certificate trust, clock skew, and disk space. Collect agent and server logs and a support package before changing multiple variables. For policy failures, confirm assignment and version compatibility before reinstalling.
Worked example
After a management server migration, 40 endpoints show disconnected. Check whether the change is site-specific. Agent logs show a TLS certificate error, and the new server certificate is not trusted by the endpoints. Fix certificate trust, restart the agent service, confirm connectivity, then install policy. Reasoning: the console status is a symptom; the agent log identifies the trust failure. Changing DNS, proxy, and packages at the same time would obscure which fix worked.
Traps
- Trusting the console dashboard alone without checking agent logs.
- Confusing “blade enabled” with “policy installed and active.”
- Overlooking proxy requirements for cloud-managed agents.
- Ignoring time skew, which breaks certificate validation and authentication.
- Deleting and re-enrolling an endpoint before collecting logs.
- Changing several variables at once and losing the root cause.