When you install and enable Process Guard, check for the existence of module files under the following path, C:\ProgramData\FireEye\xagt\exts\ProcGuard\sandbox and C:\ProgramData\FireEye\xagt\exts\plugin\ProcGuard.
The working status of the plug-in can be verified on the Endpoint Security server using the API /hx/api/v3/hosts/<agent_id>/sysinfo call to review the system information (Sysinfo) received from the endpoint agent. You should see the following fields in Sysinfo JSON data.
"ProcGuard": { "version": "1.4.2",
"plugin_state": "2",
...
}
Module Status (plugin_state) | Description |
|---|---|
0, 1 | Not initialized, initializing. |
2 | Initialized. The Process Guard is fully functional in this state. |
3, 4, 5, 6 | Failed to obtain driver interfaces, failed to guard LSASS process, generic failure cases. |
7, 8 | Uninitializing, uninitialized. |