# Elastic Defend Integration 8.18.1 not detecting/preventing at all? **URL:** \ **Category:** Endpoint Security\ **Created:** [October 19, 2025, 7:05am UTC](https://discuss.elastic.co/t/elastic-defend-integration-8-18-1-not-detecting-preventing-at-all/382817 "2025-10-19T07:05:46Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![boredchilada](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/boredchilada/32/143565_2.png) [@boredchilada](https://discuss.elastic.co/u/boredchilada)\ **Post date:** [October 19, 2025, 7:05am UTC](https://discuss.elastic.co/t/elastic-defend-integration-8-18-1-not-detecting-preventing-at-all/382817/1 "2025-10-19T07:05:46Z")
I just noticed that for some reason one of my policies was not detecting or preventing anything. I reinstalled the agent which applied the default endpoint initial policy which still had the 8.17.0 elastic defend integration version and it was blocking/prevent properly. Once i updated the integration to 8.18.1 it suddenly stopped detecting anything. Is there an issue with it? All my policies are now at 8.18.1 integration version of elastic defend... this would mean my entire windows fleet is now unprotected... i switched the endpoint-inital policy elastic defend to prevent instead of detect was around 2:05am i received alerts on windows on 8.17 after the above i updated the integration to 8.18.1 from 8.17 and it stopped detecting i tested by extracting known malware, yet the files remain on the 8.18.1 integration of elastic defend everything on the agent side seems to be fine - it shows as healthy and all green when i check ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/5/6575a1704175309d79aee290fd99029c48525c27.png) as of 3am , no detections or anything , while the test malware was “dropped” around 2:27 i’ve started a thread on github about this on the SecurityOnion repo as I use SO2 > **[elastic defend 8.18.1 integration version does not prevent or detect anything...](https://github.com/Security-Onion-Solutions/securityonion/discussions/15155)** > > Version 2.4.180 Installation Method Security Onion ISO image Description other (please provide detail below) Installation Type Standalone Location on-prem with Internet access Hardware Specs Exceed... ---
**Author:** ![boredchilada](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/boredchilada/32/143565_2.png) [@boredchilada](https://discuss.elastic.co/u/boredchilada)\ **Post date:** [October 19, 2025, 5:40pm UTC](https://discuss.elastic.co/t/elastic-defend-integration-8-18-1-not-detecting-preventing-at-all/382817/2 "2025-10-19T17:40:37Z")
So i reinstalled the Agent on the machine, and it seems to be reacting again, on elastic defend integration v8.18.1 i also notice this ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/b/3bdc97aaaed8170f5ed46a77cd3c8e2e596e808e.png) is this what i just experienced? I’m somewhat confused on what just happened… ---
**Author:** ![boredchilada](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/boredchilada/32/143565_2.png) [@boredchilada](https://discuss.elastic.co/u/boredchilada)\ **Post date:** [October 19, 2025, 6:17pm UTC](https://discuss.elastic.co/t/elastic-defend-integration-8-18-1-not-detecting-preventing-at-all/382817/3 "2025-10-19T18:17:23Z")
and now as i retest via extracting the same payloads it reacted after the reinstall from my reply above, it doesnt react… absolutely no changes made since my last reply… downloaded eicar test file.. nothing… on my linux servers it seems to be working fine and reacting without issues, i tested via spamming eicar curl commands i can see the detections in the dashboard just fine. nothing from windows tho. ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/d/4d0c6ca9def38e3233b62bb6d1970f1b0871ac21.png) ---
**Author:** ![gabriel.landau](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gabriel.landau/32/73401_2.png) [@gabriel.landau](https://discuss.elastic.co/u/gabriel.landau)\ **Post date:** [October 21, 2025, 5:44pm UTC](https://discuss.elastic.co/t/elastic-defend-integration-8-18-1-not-detecting-preventing-at-all/382817/4 "2025-10-21T17:44:55Z")
Hi @boredchilada. Can you please open a support ticket and send them an [Agent diagnostics bundle](https://www.elastic.co/docs/troubleshoot/ingest/fleet/common-problems#trb-collect-agent-diagnostics) from the problematic installation? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 18, 2025, 5:45pm UTC](https://discuss.elastic.co/t/elastic-defend-integration-8-18-1-not-detecting-preventing-at-all/382817/5 "2025-11-18T17:45:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.