Warning: Activity Monitoring Engine has only Basic Functions

When a new Linux kernel version is released, Trend Micro releases a new kernel support package for the agent. If a computer's kernel version is not currently supported, then the Activity Monitoring engine can provide only basic protection. Normal protection resumes when the agent receives the update to support the new kernel version. To prevent this problem, verify that the new kernel version is supported before you upgrade it.

Basic functions

Module	Category	Feature name	Supported	Comment
Activity Monitoring	Telemetry	File Create Event	*	*No support in container
File Open Event	*	*No support in container
Process Create Event	✔
Process Terminate Event	✔
DNS Query Event	*
Network Inbound Connection Event	✔
Network Outbound Event	✔
UDSO	Logging action for IP address, domain, file SHA-1, and file SHA-256	*	*Cannot log all DNS query events. See Trend Vision One Threat Intelligence - User Defined Suspicious Object.
Quarantine or block action for file SHA-1 and file SHA-256	✔	See Trend Vision One Threat Intelligence - User Defined Suspicious Object.
Response	Remote Shell	✔
File Collection	✔
Custom Script	✔
Network Isolation	✔
Memory Dump	✔

Reason IDs

To restore full functionality when the agent is providing only basic protection, you must resolve the cause of the warning based on the reason ID:

Reason ID 7:
1. Find out if the latest Kernel Support Package (KSP) for that particular kernel is available.
2. File a case to request KSP support.
Other reason ID:
1. Create a diagnostic package and logs.
2. Contact Trend Micro support.

The reason ID is included in events forwarded to an external Syslog, SIEM server, or Amazon SNS. Also the event description for the Anti-Malware Engine Offline or Anti-Malware Engine with Basic Functions agent displays the reason ID.

Reason ID	Event reason	Description
7	Unavailable kernel version	No driver is available for the Linux kernel version. This causes a driver offline error.
8	Failed driver loading	Loading the driver (tmhook/bmhook) into the kernel failed. This causes a driver offline error.
9	Failed driver unloading	Unloading a driver from the kernel failed. This causes a driver offline error.
14	Configuration file disable driver	Agent is set to not load the driver by configuration INI file. This causes a driver offline state.
15	Policy disable driver	Agent is set to not load the driver by Deep Security Manager or Workload Security policy. This causes a driver offline state.