Agent with Endpoint Security is not detected

[Mr.Sucuk]

Dear all,

my self managed fleet server is not able to detect the agends with endpoint integrations on the Endpoint menu. They tell me just to add/roll out a new agend with a token. But my deployment has got two agends with endpoint security. where is here the trouble? Why it not detect the endpoint security agend?

However on Host-Isolation, we still read that there is a bugfix on v8.1.1 and this was fixed there. So must be urgently updatet to v8.1.1 or is there also a possibility in v7.17? (we have currently). Unfortunately we can not use this feature at the moment.

By the way, what is the main different between the self managed fleet server and the cloud managed?

Thanks and best regards

[lesio (Leszek Kubik)]

Hello,
I'm not familiar with the self managed setup, but just out of the top of my head you could try test output command on the two machines to see if the fleet server is reachable.
The exact path depends on the OS:
Linux: /opt/Elastic/Endpoint/elastic-endpoint test output
macOS: /Library/Elastic/Endpoint/elastic-endpoint test output
Windows: C:\Program Files\Elastic\Endpoint\elastic-endpoint.exe test output

Similarly Elastic Agent has some self-diagnostic commands.

[Mr.Sucuk]

Hey,

I tested the output.

It has a successful connection to the self-managed fleet server, and the endpoints and their data are showing up like they should in the Kibana Security Tab. Only in the "Endpoints" Tab they are not recognized.

Could you explain why? Do the Endpoints only show up under Security>Endpoints if they are managed by an ECE Fleet Server?

[lesio (Leszek Kubik)]

This is a good question, unfortunately I'm not familiar with that part. I'll let you know if I find out something.

Best,