After you install and enable the AMSI module, check for the existence of module files under C:\ProgramData\Trellix\xagt\exts\amsi\sandbox and C:\ProgramData\Trellix\xagt\exts\plugin\amsi.
The working status of the plug-in can be verified on the Endpoint Security server using the API /hx/api/v3/hosts/<agent_id>/sysinfo call to review the system information (SysInfo) received from the endpoint agent. You should see the following fields in the SysInfo JSON data.
"AmsiStatus":"running",
"Amsi”: {
"version":"1.2.0",
"plugin-supported":"true",
"provider-registered":"true"
"intel-version": "464-lb.101",
"rules-version": "2021.01.20",
"intel-timestamp": "2021-02-17T19:04:16Z",
"intel-received-timestamp": "2021-03-02T16:00:48Z",
…
}Field Name | Description |
|---|---|
| AMSI is only supported on Windows 10 or Windows Server 2016 and above. When this is set to "false", the OS does not support the AMSI feature. |
| Indicates whether the Trellix AMSI module is registered with Windows OS. |
| Intel version as seen in the Security Endpoint controller. |
| AMSI rules version found in a subpackage in the Intel package. |
| Intel timestamp seen in the Security Endpoint controller. |
| Intel timestamp when the endpoint receives AMSI rules. |
The AMSI agent module creates log files in c:\Windows\Temp. Depending on the scenario, the following files are created:
amsi_install.logamsi_uninstall.logamsi_preupgrade.logamsi_upgrade.log
Check agent logs for additional messages related to the plug-in installation.
The log file for the server module installation is stored on the server in /var/log/supervisor/amsi-server_<version>_<unique_id>.log.