1. Make sure the Agents have outbound connectivity to Trend Vision One/Security Operations. If you have a Firewall or proxy, add the following two URLs in the allow list as well as in the SSL/TLS inspection settings:
   • agent-comm.workload.{cloudoneregion}.cloudone.trendmicro.com
    

   For accounts created before August 4, 2021, you can use us-1 as region.
   For new accounts created on or after August 4, 2021, you can verify the region by accessing the Account Settings page of your Trend Cloud One console.
   You can check Port numbers, URLs, and IP addresses for the updated URL list.

    

   New URLs might be added in the future. You can check Trend Cloud One Workload Security URLs for the updated list.

2. If your agent is below version 20.0.2-4960, verify the Agent Activity Monitoring configuration on the machine. The result should be as follows:

   sensorActivityEnabled=true
   Feature SENSOR state= 1

   • Windows
     1. Open the Command prompt as Administrator.
     2. Use the following command:

        cd C:\Program Files\Trend Micro\Deep Security Agent
        sendCommand.cmd --get GetConfiguration | findstr -i Sensor

        

   • Linux

     sudo /opt/ds_agent/sendCommand --get GetConfiguration | grep -i "sensor"

     

3. Check if the Agent IoT connection is online.
   • Windows
     1. Open the Command prompt as Administrator.
     2. Use the following commad:

        cd C:\Program Files\Trend Micro\Deep Security Agent
        sendCommand --get GetIoT

        

   • Linux

     sudo /opt/ds_agent/sendCommand --get GetIoT

     

4. Upgrade the Agent build. There were fixes/improvements on recently released Agent builds regarding this issue for both Windows and Linux platforms. See Agent Release Notes for more details. To upgrade, refer to the Upgrade the agent from the Computers page.
5. If the host was created as a clone, ensure that proper cloning practices were followed and the host experiencing issues is the only one communicating to the Manager for the host record experiencing the alert. For more details on proper cloning practices, refer to Cloned virtual machines using Deep Security Agent (DSA) cause conflict among multiple cloned computers
6. If the agent has been re-registered with a new configuration for MQTT, sometimes dsa-connect on the agent must be restarted for the new configuration to be applied. As part of trouble-shooting, please restart the dsa-connect process or restart the agent on the host.

If the issue persists, you can do either of the following:

• For Trend Vision One Users: Use the Trend Vision One Help and Support feature
• For Trend Cloud One Users: submit a ticket to Trend Cloud One Technical Support