How TAO agent sync and updates work
Heartbeat interval, Pull now, portal Sync / Update commands, and what to expect after wake from sleep.
How TAO agent sync and updates work
This article explains how enrolled Trustity Agents (TAO) talk to the Cloud Portal: routine check-ins, forced policy sync, version updates, and reconnect after sleep or lock screen.
Requires TAO 4.0.3518+ for the command channel, configurable heartbeat, and improved wake reconnect. Older agents still heartbeats and auto-update on the previous cadence.
Two loops (not one)
| Loop | Default | What it does |
|---|---|---|
| Heartbeat | 10 minutes (org-configurable, 30-900 seconds) | Full check-in: liveness, version, module health, policy version compare, optional policy download, auto-update advertisement |
| Command poll | 60 seconds (org-configurable, 10-300 seconds; TAO 4.0.3585+) | Lightweight: “any pending Sync / Update from the portal?” |
| VisionX evidence / GenGuard outbox | Continuous (sub-second poll; ~5s on retry) | Module events upload independently of heartbeat |
Local GUI and tray only read status.json every few seconds. That is not a portal call.
Important: Lengthening the portal check-in interval does not delay VisionX Live Events or evidence images. After a detection (with capture enabled), evidence is usually in the Cloud Portal within seconds while the endpoint is online - not after the next 10-minute heartbeat.
There is no always-on push from the portal to the endpoint. Admin “do it now” actions enqueue a row the agent picks up on the next command poll (usually within about a minute at the default interval while the device is online).
Configure check-in and command poll intervals
- Open Overview → Security Policies → TAO Agent (endpoint hardening).
- Set Portal check-in interval (seconds). Default is 600 (10 minutes).
- Set Command poll interval (seconds). Default is 60. Lower values make Sync / Update feel faster; higher values reduce portal load on large fleets.
- Save. Agents apply the new intervals after they receive the updated policy (requires Agent One 4.0.3585+ for command poll; older agents keep a fixed ~20s poll).
Use a shorter heartbeat only when you need faster natural convergence (labs, cutovers). Prefer Sync policy now for one-off changes instead of permanently lowering the fleet heartbeat.
Sync policy from the portal
- Open Deployment → Deployment control.
- Select one or more stations, or use Sync org.
- Choose Sync / Sync selected / Sync org.
The portal bumps the relevant policy version and queues refresh_policy for each agent. Default / organization policy saves bump the whole fleet; named profile saves bump agents on the tag bound to that profile. Online agents usually apply within about a minute. Offline agents apply when they next come online and poll commands. After pull, Managed devices shows an updated policy version for those endpoints. See Tags, profiles, and module seats.
Update agent version from the portal
Auto-update still uses the deployment branch target (prod Latest / Previous / Hold, eval = Latest). See TAO deployment branches and auto-update.
To force an update attempt without waiting for the next full heartbeat:
- Confirm the station’s branch target is the build you want.
- On Deployment control, use Update / Update selected / Update org.
- Confirm the prompt. Agents download and install the advertised package when they process
update_agent.
Windows quiet Setup and Linux package replace preserve enrollment under ProgramData / /var/lib/trustity/tao.
From Agent One 4.0.3572, portal Update and heartbeat auto-update no longer race on the same temp installer (that race produced Windows file in use / os error 32 on earlier 4.0.357x builds). If a station still fails mid-download on an older build, install 4.0.3572+ once (quiet Setup or a successful Update), then retry.
Current Cloud Portal GA is Agent One 4.0.3587 (Certum EV signed). Prefer 4.0.3587 or newer for new stations. Overview shows portal tags from 4.0.3587. Scheduled PAM rotation opt-in starts at 4.0.3586. Configurable command poll starts at 4.0.3585. VisionX Lock release (while threat present) starts at 4.0.3584. GenGuard detection upgrade starts at 4.0.3583 with extension 3.4.6. Local AI Runtime starts at 4.0.3573.
Pull now on the endpoint
On Windows, the agent UI and tray Pull now ask the LocalSystem engine to run an immediate heartbeat/policy refresh (signal file under ProgramData). Use this after network restore or when validating a policy change locally.
After sleep, lock, or hibernate
TAO 4.0.3518+ retries heartbeat with short backoff when the first call fails after wake, shortens the recovery interval after consecutive failures, and the Windows service requests an immediate pull when it detects a long resume gap.
If the tray or GUI still shows disconnected briefly:
- Wait ~15-30 seconds for automatic recovery, or
- Click Pull now, or
- Confirm
TrustityAgentis running and outbound HTTPS to the portal works.
Avoid re-enrollment for a temporary offline flash after resume.