Don’t forget to configure the Siemplify integration in your Marketplace.

Both the Publisher and the Agent will have logs which you can use to monitor and troubleshoot where necessary.
Remote jobs are sent with a unique ID which can be tracked in the logs.

The Agent Information presented in the Settings screen includes:

  • Last Agent Communication Time
  • Last Action Execution Time
  • Agent Version
  • Deployment Type
  • Required Siemplify Version
  • Agent IP
  • Agent Hostname
  • Paired Publisher
  • Environments

Test the Remote Agents

To perform a basic test of the full flow, try deploying an agent locally (in a disconnected network) and connecting to one of your integrated security tools through the agent.

  1. Create a new agent and send the download link to an email address you can access.
  2. Click on the link in the email and download the agent.
  3. Deploy it locally.
  4. Make sure the agent can communicate with the Publisher you assigned to it (i.e. ping the Publisher from the Agent command line).
  5. Make sure the agent can also communicate with another product (e.g. Active Directory, ServiceNow). We will test the flow from Chronicle SOAR to the agent and back.
  6. Setup the relevant integration to run remotely and test the actions.

Both integrations and connectors provide testing features and show the status of the assigned Remote Agents in the  platform.
The same flow can be repeated with Agents deployed on remote sites.

Disable an Agent

To disable an agent:

  1. Navigate to Settings > Advanced > Remote Agents.
  2. Click Edit on the required agent.
  3. Check the Disable Agent checkbox. Note that you will receive a warning message.
  4. Click Save.

An agent that was disabled will not run actions and connectors or communicate with Chronicle SOAR until enabled.

Delete an Agent

Note that a deleted agent will still appear in the Platform for archive purposes but cannot be used.

To delete an agent:

  1. Navigate to Settings > Advanced > Remote Agents.
  2. Click Edit on the required agent.
  3. Check the Disable Agent checkbox. Note that you will receive a warning message.
  4. Click Save.