Elastic Agent 9.3.7 CPU spikes

Elastic Stack Elastic Agent
1

I mostly see the spiking when apps are being opened or occasionally while they are being used. I tested using standard apps like Outlook, Excel, Word, Chrome. Doing a search in Chrome for example caused a spike from 7% to 42%. If the computer is idle, the CPU process stays around 2-3%

I already limited the CPU usage to 1 on the policy. Elastic defend is set to detect. Scan files upon modification is off.

Any tips to investigate further are appreciated.

"local_metadata": {
    "os": {
      "kernel": "10.0.26100.8875 (WinBuild.160101.0800)",
      "name": "Windows 11 Enterprise",
      "family": "windows",
      "version": "10.0",
      "platform": "windows",
      "full": "Windows 11 Enterprise(10.0)"
    },
    "elastic": {
      "agent": {
        "build.original": "9.3.8 (build: 6fa41f194fafa51be7f4b8142981b0d8aa42468c at 2026-07-15 16:23:01 +0000 UTC)",
        "unprivileged": false,
        "upgradeable": true,
        "log_level": "info",
        "fips": false,
        "id": "",
        "complete": false,
        "version": "9.3.8",
        "snapshot": false
2

Hi @etrevino-lumificyber. Two ideas.

One, you could try reproducing the spike while collecting an Elastic Agent diagnostics bundle. Specifically by selecting Collect additional CPU metrics. You can follow our diagnostics guide to do this. Note that you'll want to review and redact the diagnostics bundle rather than upload it publicly.

Two. You should also check whether another AV or EDR product is installed. In our Elastic Defend troubleshooting guide, we explain that feedback loops with other security software can spike CPU. If this is the case, there are instructions you can follow on that page to fix this.