Troubleshooting
Diagnose stale protection, failed scans, access denial, missing evidence, and ambiguous response results.
Troubleshooting starts with the affected resource, observation time, policy revision, and request or operation ID. Check the selected organization and permission boundary before concluding a resource is missing.
A service is active but traffic is unprotected
At Network protection → Services → Service → Coverage, compare assigned ingress with current DNS or routes and edge observations. Test the production hostname and verify the origin sees the same benign request. A direct origin, alternate record, unsupported protocol, or route outside the admitted prefix can bypass protection. Correct the path using service onboarding; restarting an endpoint agent does not repair edge routing.
A policy is published but not applied
Open Policies → Policy → Adoption. For offline, restore executor management reachability and inspect its last contact. For failed, read the capability or validation error and keep the previous applied revision visible. For conflicting assignments, resolve group priorities and republish. Do not repeatedly publish identical revisions to fix an unreachable device.
A scan reports few findings
At Assessments → Runs → Run → Coverage, inspect resolved targets, exclusions, reachability, authentication, privileges, and skipped checks. A completed job with authentication failure is not an authenticated assessment. Test the credential on a pilot target, correct network or account access, and create a new run under the approved scope.
A user cannot access a private application
Open Access → Sessions → Denied requests. Distinguish identity/MFA failure, group denial, stale posture, gateway unavailability, and unreachable backend. Inspect the exact posture age and policy revision. Correct the specific dependency; do not disable posture for the entire organization to recover one session.
Isolation is pending or its result is ambiguous
At Incident → Response → Action, inspect approval, deadline, executor contact, and per-target results. A 202 response, timeout, or missing heartbeat cannot establish isolation. Reconcile the original action and operation before requesting a replacement. If the deadline expired before execution, review current conditions and create a new authorized action. Do not requeue the expired request.
Evidence is unavailable
Open Incident → Evidence → Item and inspect collection result, retention, hold, storage object status, and integrity. An expired raw artifact can leave retained metadata. A lost local quarantine store cannot be reconstructed from a detection alone. For self-hosted storage failures, check Installation → Health → Storage and recover the matching artifact and key set through backup recovery.
Notifications or feeds are stale
At Organization → Integrations → Integration → Deliveries, inspect receiver responses, credentials, TLS, and retry state. Retry the original event after fixing the receiver. For feeds, inspect Intelligence → Feeds and the enabled feed worker's egress and identity. A DDoS Connector is not required for local webhook delivery or direct feed synchronization.
Collect diagnostics
Use Installation → Diagnostics → Create bundle or the affected resource's diagnostics control. Inspect its redaction preview before export. Include request IDs, operation IDs, resource IDs, release, timestamps, and error codes. Exclude secrets, private keys, raw identity files, and unnecessary employee content. Use the urgent support path shown in Organization → Support for an active incident.