I have a Windows server on which Elastic Defend is enabled, but only the Event Collection component is active. Nothing else is enabled ā no malware protection, no ransomware protection, etc... The sole purpose is to collect event logs.
On the same server, I want to install SAP Crystal Reports 2025.
The installation fails with the following error:
"Failed to update cache for execution. Program will exit."
There are multiple things that "Event Collection" and "collecting event logs" might mean with Elastic Defend and so let me give you an example of what we see occasionally.
If you are simply scanning/monitoring for malware, but not preventing. Almost everything that would need to be done to do malware prevention has to be done. File activity is monitored, process activity is monitored, files are hashed. After all that is done, IF the file is categorized as malicious, then Defend will effectively call "DoMitigation()" otherwise it will do nothing.
The conflict you're describing most often happens when there's a conflict between Endpoint opening a file to scan it and the other software attempting to open/access/modify the file at the same time. We take steps to open files in a way that will not conflict, but it is not always successful depending on how the other software is implemented. Monitoring of files is the point that causes the conflict, not prevention in this kind of conflict.
So even if you're only putting a security product in "monitor" or "collect" only, it still needs to be configured with exclusions and exceptions for other products that would either create a positive feedback loop or have conflicts with each other.
IF the file is categorized as malicious, then Defend will effectively call "DoMitigation()" otherwise it will do nothing.
With my Defend config, the file shouldn't be categorized as malware protection is disabled ? I should only get a file.open / file.write event, and nothing should be blocked?
Nothing should block a file open/write or I miss something ? For me, this setup is basically equivalent to running Sysmon ?
@marrc.rousseau sorry for the delay in getting back to you. Many of our features have overlapping paths. File Events can drive both the Events and malware scanning. In most instances we are not collecting the actual activity twice and so like you found, a lot of the File Event path is still enabled even though Malware protection is disabled.
If you have feature A turned off and feature B turned on.
If feature B needs data from events that would otherwise be controlled by feature A.
Then endpoint will enable what i needs from feature A but not will not emit those events to the stack.
Malware protection is actually a good example of that. You can enable malware protection, but configure file events to be disabled. Malware protection needs file events for modification scanning. In that case, file events would be internally enabled but only used to drive the malware protection feature without being sent to the stack.
As a side note, can you share what version of endpoint and the stack you were running and saw this? We made improvements to how file conflicts are handed this year and am curious if you're running into this with one of the like 9.3+ releases or if its 8.19-9.2ish
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.
