I just noticed that for some reason one of my policies was not detecting or preventing anything. I reinstalled the agent which applied the default endpoint initial policy which still had the 8.17.0 elastic defend integration version and it was blocking/prevent properly.
Once i updated the integration to 8.18.1 it suddenly stopped detecting anything.
Is there an issue with it?
All my policies are now at 8.18.1 integration version of elastic defend... this would mean my entire windows fleet is now unprotected...
i switched the endpoint-inital policy elastic defend to prevent instead of detect was around 2:05am
i received alerts on windows on 8.17
after the above i updated the integration to 8.18.1 from 8.17 and it stopped detecting
i tested by extracting known malware, yet the files remain on the 8.18.1 integration of elastic defend
everything on the agent side seems to be fine - it shows as healthy and all green when i check
as of 3am , no detections or anything , while the test malware was “dropped” around 2:27
i’ve started a thread on github about this on the SecurityOnion repo as I use SO2
