Skip to main content

Troubleshooting

Common issues and solutions for The One Defend.

Defend Module Not Activating on Enrolled Devices​

Symptoms: RMM agent is active but Defend status shows "Inactive" or doesn't appear.

Solutions:

  1. Verify the organization has an active Defend subscription in Hub Billing
  2. Confirm the device's RMM agent is online and reporting
  3. Wait for the next agent heartbeat — module activation happens on heartbeat check
  4. Check that the agent version supports Defend (minimum version required)

Device Shows Agent Active But Telemetry Not Flowing​

Symptoms: Device shows "Defend: Active" but no events appear in the detection dashboard or investigation timeline.

Solutions:

  1. Verify outbound connectivity to theonedefend-events.servicebus.windows.net on port 443
  2. Check for firewall or proxy rules blocking Event Hub endpoints
  3. Confirm the device's SAS token has not expired (auto-refreshes every 24 hours)
  4. Check the agent's local disk buffer — if full, the buffer may need to be cleared
  5. Verify ETW providers (Windows), ESF entitlements (macOS), or eBPF permissions (Linux) are properly configured

High Rate of False Positives​

Symptoms: Many detections are being marked as False Positive, creating alert fatigue.

Solutions:

  1. If the device was recently enrolled, wait for the 7-day behavioral baseline learning period to complete
  2. Add rule exclusions for known-good software that triggers detections (e.g., backup agents, monitoring tools, deployment scripts)
  3. Adjust the behavioral AI anomaly threshold in Settings → Behavioral AI (raise from default 75 to reduce sensitivity)
  4. Review and tune process exclusions in the agent configuration for noisy processes
  5. Mark False Positives consistently — the ML pipeline incorporates feedback during weekly retraining

Detection Not Generating PSA Ticket​

Symptoms: Critical or high-severity detection fires but no PSA ticket is created.

Solutions:

  1. Verify PSA integration is configured in Settings → Response Automation → PSA Integration
  2. Check that auto-ticket creation is enabled for the detection severity level
  3. Confirm the PSA API URL and integration key are correct
  4. Check the integration health dashboard for PSA connectivity issues

Isolate Action Not Taking Effect​

Symptoms: "Isolate Device" action shows as completed but the device still has network access.

Solutions:

  1. Confirm the agent is online — isolation requires the agent to receive and execute the command
  2. Check the response action verification result — it may show failure details
  3. On Windows, verify that the agent has permissions to modify Windows Firewall rules
  4. If the device is behind a NAT or VPN, the RMM management channel may need firewall exceptions

Rewind Failed​

Symptoms: Ransomware rewind recovery fails during execution.

Solutions:

  1. VSS not enabled: On Windows, ensure Volume Shadow Copy is enabled on affected drives
  2. No backup available: Verify the Backups product is active and has a snapshot at or before the rewind target
  3. Insufficient storage: VSS snapshots require disk space — check available space
  4. Backups API connectivity: Run a dry-run test in Recovery → Test to validate the pipeline
  5. Timing: If the attack ran for a long time before detection, the rewind target may be before the oldest available backup

Compliance Report Missing Controls​

Symptoms: Generated compliance report shows gaps in controls that you expected to be covered.

Solutions:

  1. Verify telemetry is flowing from all relevant devices — gaps in coverage create control gaps
  2. Some controls require manual attestation (physical security, personnel checks) — these cannot be verified through telemetry
  3. Check device enrollment coverage — devices without Defend active are excluded from compliance metrics
  4. Ensure the reporting period captures enough data (at least 30 days for meaningful metrics)

IOC Feed Not Updating​

Symptoms: IOC feeds show stale data or "Last refresh" timestamp is more than 6 hours old.

Solutions:

  1. Check Event Hub connectivity from the background function app
  2. Verify the IOC feed source URLs are accessible (abuse.ch, OTX may have temporary outages)
  3. Check the background timer function app health in Azure
  4. For AlienVault OTX, verify the API key is valid and not rate-limited

Process Tree Not Loading in Investigation​

Symptoms: Investigation workspace opens but the process tree tab shows "No data available."

Solutions:

  1. Check the detection timestamp — process tree data requires telemetry in the ±30-minute window
  2. If the event is older than 90 days, data may have moved to cold archive and is no longer queryable in real time
  3. Verify the device was collecting process events at the time (check event type toggles in agent config)
  4. For macOS/Linux, ensure ESF/eBPF was properly initialized at the time of the event

Agent Consuming High CPU​

Symptoms: The RMM agent (with Defend module) is using consistently high CPU on an endpoint.

Solutions:

  1. Check the sampling rate — reduce from 1.0 to 0.5 for high-activity endpoints
  2. Review process exclusions — noisy processes (build tools, database engines) should be excluded
  3. Increase the batch interval from 1000ms to 2000ms or higher to reduce signing overhead
  4. On Windows, check for ETW provider misconfiguration — too many providers enabled
  5. Contact support if the issue persists after tuning — provide the agent diagnostic log

Behavioral Baseline Producing Unreliable Scores After Software Deployment​

Symptoms: After a major software rollout, anomaly scores spike across many devices.

Solutions:

  1. Bulk-reset baselines for affected devices — this re-enters the 7-day learning period
  2. Add the new software to process exclusions if it's generating excessive telemetry
  3. Temporarily raise the anomaly threshold to reduce false positive alerts during the transition
  4. The weekly ML retraining will naturally adjust if analysts mark these as False Positives
ℹ️If you encounter an issue not listed here, contact support with the device ID, detection ID (if applicable), and the agent diagnostic log.

Next Steps​