# Elastic Endpoint cannot send alerts to kibana

**URL:** <https://discuss.elastic.co/t/elastic-endpoint-cannot-send-alerts-to-kibana/314644>\
**Category:** Endpoint Security\
**Created:** [September 18, 2022, 12:53pm UTC](https://discuss.elastic.co/t/elastic-endpoint-cannot-send-alerts-to-kibana/314644 "2022-09-18T12:53:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Fatima](https://avatars.discourse-cdn.com/v4/letter/f/f17d59/32.png) [@Fatima](https://discuss.elastic.co/u/Fatima)\
**Post date:** [September 18, 2022, 12:53pm UTC](https://discuss.elastic.co/t/elastic-endpoint-cannot-send-alerts-to-kibana/314644/1 "2022-09-18T12:53:11Z")

</div>

Hi people,  
I have configured the beats and EDR and I am getting all the events from the different hosts. I have enabled all the preset security rules but I am not getting any alerts.  
This is the message I get when doing the test.  
I have already installed the certificate on the host machine

 ![Capture](https://us1.discourse-cdn.com/elastic/original/3X/4/3/432b6c7e5e62cfe3601acc6c6600b95478b3314c.png)

---

<div class="post-metadata">

**Author:** ![ferullo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ferullo/32/74240_2.png) [@ferullo](https://discuss.elastic.co/u/ferullo)\
**Post date:** [September 20, 2022, 3:24pm UTC](https://discuss.elastic.co/t/elastic-endpoint-cannot-send-alerts-to-kibana/314644/2 "2022-09-20T15:24:39Z")

</div>

Hi @Fatima thanks for checking out Endpoint!

When you say "I am getting all the events from the different hosts", what events/documents do you mean are appearing in Elasticsearch/Kibana? Please focus on just documents from the host you ran that `elastic-endpoint.exe test output` command on.

What I'm trying to understand is what Elastic components are or are not working for you. It is possible that some of the components (Elastic Agent, various Beats depending on the integrations you've installed, or Elastic Endpoint) to work while others do not work. It clearly looks like Endpoint is not working but I am not sure if the problem is isolated to just Endpoint. Knowing that will impact how we diagnose and fix this. The fact that you aren't getting any alerts is probably caused by documents from Endpoint and/or Beats not being successfully written to Elasticsearch, so let's focus on getting those documents written to Elasticsearch for now.

From looking at the output, I think it's worth at least taking a stab at what might be wrong and offering some initial help. It appears that the certificate you've installed isn't valid for the DNS/IP being written to. If this is the case, you can modify the level of SSL verification being done to hopefully address the issue.

In Endpoint's existing config file on disk (`c:\Program Files\Elastic\Endpoint\elastic-endpoint.yaml`) you should currently see a section like:

```nohighlight
output:
  elasticsearch:
    api_key: REDACTED
    hosts:
    - https://REDACTED

```

To update the SSL verification, go to Fleet -\> Settings. Select the edit icon on the right for the output being used in the Outputs list (it's probably "default"). A right hand fly out will appear. In it, add the following to the Advanced YAML configuration.

```auto
ssl:
   verification_mode: certificate

```

(Other possible `verification_mode` values are [documented](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#client-verification-mode) online. If `certificate` does not work you might want to try `none`, if that is acceptable for your use case)

After you hit Save and apply settings, the change will be pushed out to all Agents in your Fleet using that output config. To verify it applied correctly to the Endpoint you're testing with, you can check out `c:\Program Files\Elastic\Endpoint\elastic-endpoint.yaml` again. You should now see content in it like

```nohighlight
output:
  elasticsearch:
    api_key: REDACTED
    hosts:
    - https://REDACTED
    ssl:
      verification_mode: certificate

```

I hope this helps.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 18, 2022, 3:24pm UTC](https://discuss.elastic.co/t/elastic-endpoint-cannot-send-alerts-to-kibana/314644/3 "2022-10-18T15:24:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.