Agent with Endpoint Security is not detected

Elastic Security
1

Dear all,

my self managed fleet server is not able to detect the agends with endpoint integrations on the Endpoint menu. They tell me just to add/roll out a new agend with a token. But my deployment has got two agends with endpoint security. where is here the trouble? Why it not detect the endpoint security agend?

However on Host-Isolation, we still read that there is a bugfix on v8.1.1 and this was fixed there. So must be urgently updatet to v8.1.1 or is there also a possibility in v7.17? (we have currently). Unfortunately we can not use this feature at the moment. :frowning:

By the way, what is the main different between the self managed fleet server and the cloud managed?

Thanks and best regards

2

Hello,
I'm not familiar with the self managed setup, but just out of the top of my head you could try test output command on the two machines to see if the fleet server is reachable.
The exact path depends on the OS:
Linux: /opt/Elastic/Endpoint/elastic-endpoint test output
macOS: /Library/Elastic/Endpoint/elastic-endpoint test output
Windows: C:\Program Files\Elastic\Endpoint\elastic-endpoint.exe test output

Similarly Elastic Agent has some self-diagnostic commands.

3

Hey,

I tested the output.

MicrosoftTeams-image (1)
MicrosoftTeams-image (1)820×181 22.5 KB

It has a successful connection to the self-managed fleet server, and the endpoints and their data are showing up like they should in the Kibana Security Tab. Only in the "Endpoints" Tab they are not recognized.

Could you explain why? Do the Endpoints only show up under Security>Endpoints if they are managed by an ECE Fleet Server?

4

This is a good question, unfortunately I'm not familiar with that part. I'll let you know if I find out something.

Best,

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.