Here's a vm I have running endpoint security:
I changed the Default output for Agent integrations and for Agent monitoring , which should not affect this policy. It even gave me a warning that the change would affect 0 agents and 0 agent policies. However, every agent was updated.
This is the same vm now:
I get this issue on 8.2.2 and 8.2.3, this was from a cloud instance running 8.2.2. I have also triggered it other ways than changing fleet's default output. I think it will occur if you change the agent policy's output. The vm in the screenshot is running ubuntu 20, but I have also seen it on windows 10.
The only work around I have found is putting the agent on a policy without endpoint security and then putting it back on its original policy with endpoint security.
This seems like a bug to me, is it being tracked somewhere already?