How TAO agent sync and updates work
Heartbeat interval, Pull now, portal Sync / Update commands, and what to expect after wake from sleep.
How TAO agent sync and updates work
This article explains how enrolled Trustity Agents (TAO) talk to the Cloud Portal: routine check-ins, forced policy sync, version updates, and reconnect after sleep or lock screen.
Requires TAO 4.0.3518+ for the command channel, configurable heartbeat, and improved wake reconnect. Older agents still heartbeats and auto-update on the previous cadence.
Two loops (not one)
| Loop | Default | What it does |
|---|---|---|
| Heartbeat | 10 minutes (org-configurable, 30–900 seconds) | Full check-in: liveness, version, module health, policy version compare, optional policy download, auto-update advertisement |
| Command poll | About 60 seconds | Lightweight: “any pending Sync / Update from the portal?” |
| VisionX evidence / GenGuard outbox | Continuous (sub-second poll; ~5s on retry) | Module events upload independently of heartbeat |
Local GUI and tray only read status.json every few seconds. That is not a portal call.
Important: Lengthening the portal check-in interval does not delay VisionX Live Events or evidence images. After a detection (with capture enabled), evidence is usually in the Cloud Portal within seconds while the endpoint is online — not after the next 10-minute heartbeat.
There is no always-on push from the portal to the endpoint. Admin “do it now” actions enqueue a row the agent picks up on the next command poll (usually within a minute while the device is online).
Configure the check-in interval
- Open Overview → Security Policies → TAO Agent.
- Set Portal check-in interval (seconds). Default is 600 (10 minutes).
- Save. Agents apply the new interval after they receive the updated policy.
Use a shorter interval only when you need faster natural convergence (labs, cutovers). Prefer Sync policy now for one-off changes instead of permanently lowering the fleet interval.
Sync policy from the portal
- Open Deployment → Deployment control.
- Select one or more stations, or use Sync org.
- Choose Sync / Sync selected / Sync org.
The portal bumps the org policy version and queues refresh_policy for each agent. Online agents usually apply within about a minute. Offline agents apply when they next come online and poll commands.
Update agent version from the portal
Auto-update still uses the deployment branch target (prod Latest / Previous / Hold, eval = Latest). See TAO deployment branches and auto-update.
To force an update attempt without waiting for the next full heartbeat:
- Confirm the station’s branch target is the build you want.
- On Deployment control, use Update / Update selected / Update org.
- Confirm the prompt. Agents download and install the advertised package when they process
update_agent.
Windows quiet Setup and Linux package replace preserve enrollment under ProgramData / /var/lib/trustity/tao.
Pull now on the endpoint
On Windows, the agent UI and tray Pull now ask the LocalSystem engine to run an immediate heartbeat/policy refresh (signal file under ProgramData). Use this after network restore or when validating a policy change locally.
After sleep, lock, or hibernate
TAO 4.0.3518+ retries heartbeat with short backoff when the first call fails after wake, shortens the recovery interval after consecutive failures, and the Windows service requests an immediate pull when it detects a long resume gap.
If the tray or GUI still shows disconnected briefly:
- Wait ~15–30 seconds for automatic recovery, or
- Click Pull now, or
- Confirm
TrustityAgentis running and outbound HTTPS to the portal works.
Avoid re-enrollment for a temporary offline flash after resume.