PREVIEW

Security or endpoint agent not running

Skill: security-agent-repair · Risk: high · Steps: 13

Diagnoses and repairs endpoint security agent issues including stopped processes, outdated versions, unapproved system extensions, connectivity failures to management consoles, and compliance posture problems. Supports CrowdStrike Falcon, SentinelOne, Jamf Protect, Carbon Black, Cylance, and Microsoft Defender.

What it does, step by step

Step 1. Detects installed security agents, checks their versions, and reports whether each has recently reached its management console. read-only · survey_security_agent

Step 2. Checks whether the security agent’s system extension is approved and active on Mac devices. read-only · check_system_extension

Step 2b. Asks the user to approve the pending system extension in system settings so the agent can activate. asks the user · wait_for_user_ack

Step 3. Reviews recent agent logs for authentication, connectivity, extension, or tamper-protection errors. read-only · check_agent_logs

Step 4. Restarts the stopped security agent process once no blocking issue is found. makes a change, asks permission · restart_process

Step 4b. Asks the user to try the vendor’s built-in refresh option when a direct restart is blocked. asks the user · wait_for_user_ack, check_agent_process

Step 5. Checks system integrity protection, disk encryption, and firewall status for compliance. read-only · survey_compliance_posture

Step 6. Turns the device firewall back on when it was found disabled. makes a change, asks permission, preview first · enable_firewall

Step 7. Checks the device’s mobile device management enrollment and policy compliance status. read-only · c_mdm_diagnose_configuration

Step 8. Tells the device to check in and re-apply all its assigned configuration. makes a change, asks permission, preview first · c_mdm_reapply_configuration

Step 9. Asks the user to wait briefly, then confirms when ready to re-check the policy update. asks the user · wait_for_user_ack

Step 10. Re-checks whether the security agent is running after the configuration update lands. read-only · check_agent_process

Step 11. Summarizes the agent’s overall health and flags any issues needing IT follow-up. no tools

Tools it may use

survey_security_agent, survey_compliance_posture, check_system_extension, check_agent_logs, check_agent_process, restart_process, enable_firewall, c_mdm_diagnose_configuration, c_mdm_reapply_configuration, wait_for_user_ack