Troubleshoot EDR

When something looks wrong, start with the symptom quick index. It maps a symptom to the first tool to run and what that tool tells you.

Your situationGuide
Something looks wrong and you need a starting pointSymptom quick index
The agent won’t start, data isn’t flowing, or lag is climbingTroubleshoot common EDR issues
The agent crashed or restarted and you have its logEDR log post-mortem playbook

Before you act on a live metrics or UI reading, cross-check it against edr-inspect state. A metrics snapshot is point-in-time and resets each run, so it can catch a transient at its worst instant. See Data not flowing.


Was this page helpful?

Thank you for your feedback!