VERISCO Alertio
/Reference
Troubleshooting
Start from what you see. Each section lists the likely causes in the order worth checking them.
A screen is empty#
Alertio shows live data only; it has no demonstration mode. An empty screen means one of two things:
| Check |
Where |
| Does the time range contain any data? |
Widen it to 7d or All. Many screens are empty over the last hour on a quiet network. |
| Is the detection engine answering? |
The Detection Engine indicator in the top bar. If it is not green, no new data is arriving. |
Empty screens always say why they are empty. Read the message before assuming a fault.
A service indicator is not green#
| Indicator |
What stops working |
| Detection Engine |
New alerts, endpoints and their inventory. Data already stored stays readable. |
| Correlation Engine |
New incidents. Existing incidents stay readable. |
| Threat Intelligence |
Lookups and the Enrichment tab. Check the key under Settings → Integrations with Test connection. |
| AI Analyst |
New AI analyses. Saved analyses stay readable, and everything else keeps working. |
When several indicators turn red at the same moment, the cause is usually one shared dependency, not several faults. Contact your VERISCO administrator.
An alert I expected is not in the Triage Queue#
- It was suppressed. Find it on the Alert Pipeline under Suppressed and open the inspector: the four factors show why it scored below the gate.
- Its machine is not classified. Unclassified machines count as Medium. Classify it in asset criticality.
- A trust rule lowered it. Check trust rules for a rule matching the host.
- It is outside the time range. The queue follows the range you selected.
The queue is too long#
| Cause |
Fix |
| Important and unimportant machines weigh the same |
Classify machines in asset criticality, including Low for test and lab machines. |
| Known-good activity keeps scoring |
Add a trust rule for it. |
| The weights do not fit your environment |
Tune them, one change at a time, watching the Alert Pipeline. |
An endpoint is offline or never connected#
| Status |
Check |
| Never connected |
The install command ran on the machine, the machine can reach your Alertio server, and its enrolment token had not expired. Generate a fresh one if in doubt. |
| Offline |
The machine is switched on and on the network, and the agent service is running. |
| Version drift |
Not an error. The agent works but is behind the current version. |
A response action shows Failed or Expired#
| Status |
Meaning and next step |
| Failed |
The result column says why. Most often the agent was offline, or the action is not enabled on that machine. |
| Expired |
Normal for a block: it lifted after its timeout. Run it again if you still need it. |
| Refused |
The platform declined to run it and states the reason, such as a missing acknowledgement. |
A script deployment fails#
| Symptom |
Cause |
| A signature error on a target |
The endpoint does not yet trust the certificate the packages are signed with. Your VERISCO administrator installs it on the endpoint once. |
| A target stays pending |
The agent is offline. Deployment completes when it reconnects. |
| Build WPKs is unavailable |
No script is published yet. Publish one on Response Scripts. |
Someone cannot sign in#
| Cause |
Fix |
| Forgotten password |
An administrator resets it from Accounts. There is no reset by email. |
| The account is disabled |
An administrator enables it from Accounts. |
| Too many attempts |
Sign-in attempts are rate limited. Wait a few minutes and try again. |
Something missing or wrong on this page? Tell us and we will fix it.