ElasticDefend Integration is installed but API says otherwise

Elastic Security
1

I am on Elasticsearch Free Enterprise Trial version 8.12.2

Version

I have enabled the Elastic Defend integration on the integration policy of the agent.
I can see the agent is enabled.

image
image1308×409 40.2 KB

However when I try to issue a command via the Kibana list the processes on that agent I get this error:

["The host does not have Elastic Defend integration installed"],

2

Can you confirm that this Policy has Defend included and is applied to the endpoint you were expecting to test? The Integration view doesn't say that.

I suggest opening Fleet view.

image
image1893×701 71.9 KB

Then click on the host of interest and confirm that Defend is indeed added to the policy and is healthy

image
image1922×1104 167 KB

3

Hi there,
this is what I see on the host:

image
image1255×906 107 KB

It seems correct no?

4

I can see you've also got Osquery, so I just wonder which component was used to list the processes.

Did you run the command processes from response console as described here Endpoint response actions | Elastic Security Solution [8.15] | Elastic

This feature requires relevant license and privileges. Maybe the error is misleading.