Can Elastic Defend Event Collection interfere with software installation?

Elastic Security Endpoint Security
1

Hello,

I have a Windows server on which Elastic Defend is enabled, but only the Event Collection component is active. Nothing else is enabled ā€” no malware protection, no ransomware protection, etc... The sole purpose is to collect event logs.

On the same server, I want to install SAP Crystal Reports 2025.

The installation fails with the following error:

"Failed to update cache for execution. Program will exit."

This is a known issue:
SAP KBA 1868305 : 1868305 - Error: 'Failed to update cache for execution. Program will exit', when installing Crystal Reports

SAP recommends disabling any antivirus or security software during the installation.

If I disable Elastic Defend, the installation succeeds, which I find puzzling.

How is it possible that simply collecting event logs can prevent the installation from working?

I don't have anything enabled in the "Elastic Defend" policy that should block anything.

Could this issue also occur with Sysmon?

Is it because the event collection layer is more intrusive than one might think?

I'm open to any insights or suggestions :wink:

Thanks

2

There are multiple things that "Event Collection" and "collecting event logs" might mean with Elastic Defend and so let me give you an example of what we see occasionally.

If you are simply scanning/monitoring for malware, but not preventing. Almost everything that would need to be done to do malware prevention has to be done. File activity is monitored, process activity is monitored, files are hashed. After all that is done, IF the file is categorized as malicious, then Defend will effectively call "DoMitigation()" otherwise it will do nothing.

The conflict you're describing most often happens when there's a conflict between Endpoint opening a file to scan it and the other software attempting to open/access/modify the file at the same time. We take steps to open files in a way that will not conflict, but it is not always successful depending on how the other software is implemented. Monitoring of files is the point that causes the conflict, not prevention in this kind of conflict.

So even if you're only putting a security product in "monitor" or "collect" only, it still needs to be configured with exclusions and exceptions for other products that would either create a positive feedback loop or have conflicts with each other.

3

"If you are simply scanning/monitoring for malware, but not preventing"

The malware mode is completely disabled, not even in detection mode.

image
image833Ɨ246 13.8 KB

The only thing enabled in Defend policy is "Event collection"

image
image819Ɨ392 16.2 KB

IF the file is categorized as malicious, then Defend will effectively call "DoMitigation()" otherwise it will do nothing.

With my Defend config, the file shouldn't be categorized as malware protection is disabled ? I should only get a file.open / file.write event, and nothing should be blocked?

Nothing should block a file open/write or I miss something ? For me, this setup is basically equivalent to running Sysmon ?

4

with advanced endpoint option :

windows.advanced.kernel.filewrite = false (default=true)

windows.advanced.kernel.fileopen = false (default=true)

SAP Installation works

5

Thanks for sharing your solution @marrc.rousseau !