Troubleshoot Prismara Endpoint Security

Cause: The device is switched off or has no internet connection, the sensor service has stopped, or a firewall or proxy is blocking the connection to Prismara Endpoint Security.

Resolution:

1. Check that the device is switched on and can open a public website such as https://example.com.
2. Check the sensor is running. On Windows, open Services and look for Prismara Endpoint Security. On Linux, run systemctl status prismara-endpoint-sensor.
3. Restart the device.
4. Ask your network team to allow outbound HTTPS to https://endpoint.prismara.eu, including through any proxy.
5. Check the device’s date and time are set automatically.
6. In the console, open the device and check Last seen. If it hasn’t changed after these steps, reinstall the sensor.

Cause: Another security product on the device sees the sensor install as unknown software and stops it.

Resolution:

1. Don’t turn off or uninstall your existing protection to get the install through. The device would be unprotected.
2. Ask your security team to allow the Prismara Endpoint Security installer and sensor in the other security product.
3. Run the install again.
4. If the install still fails, contact support with the name and version of the other security product.

Cause: Both products are set to actively block threats on the same device, or a Microsoft Defender policy is overriding the settings you expect.

Resolution:

1. In the Endpoint Security console, open the device’s Policy and check which product is set to take the lead on that device.
2. While you’re moving across, decide which product actively blocks threats on each device group, and set the other to monitor only, rather than having both block the same threats.
3. Check whether a Microsoft Defender policy from another management tool is overriding local settings. Change it in that tool.
4. When you’re ready to hand over, update the device group’s policy in Prismara Endpoint Security, then change the Microsoft Defender policy to match.
5. Never leave a device with both products turned off. Check the device shows Protected after each change.

Cause: The sensor is checking a large number of files, for example during its first scan after install, a software update or a large file copy. Another security product scanning the same files can make this worse.

Resolution:

1. Wait for the first scan after install to finish. Usage normally drops once it’s complete.
2. Check whether another security product is also scanning the same files. If so, see the Microsoft Defender entry above.
3. In the console, open the device and select Performance to see when the high usage started and what the sensor was doing.
4. If the problem continues, contact support with the device name and the time the high usage was seen.

Cause: The software behaves in a way that looks like a threat, or it’s an internal tool that isn’t widely known.

Resolution:

1. Open the incident and check the file or process in Evidence. Confirm with the software’s owner that it’s legitimate.
2. Select Submit for analysis on the file so it can be reviewed.
3. To stop it being blocked while you wait, select Allow and choose the device groups the allow rule applies to. Keep the scope as narrow as you can.
4. If the file was quarantined, select Restore. This is a response action, so it needs approval.
5. Resolve the incident with the classification False positive.

Cause: No approver has reviewed the request yet, approvers haven’t been set up for your organisation, or the person who requested the action is the only approver.

Resolution:

1. Check Response actions > Pending approval to see who has been notified.
2. Contact an approver directly and ask them to review the request.
3. Remember that you can’t approve your own request. Another approver must do it.
4. Administrators: check that at least two people are set up as approvers, so requests aren’t left waiting when one is away.
5. If the action is approved but stays at Approved without running, the device may be offline. The action runs when the device next connects.