Endpoint 7.9 "Degraded and dashboards"

Thank you!

I looked through them and I see the issue with the Policy failure. If you go into the Security App's Administration tab and click on the "Configuration Status" for the failing host you should see a dialog pop up on the right side of the screen that lets you drill down into the policy and see the failure in a nice UI.

But, since you shared the payload document for Endpoint from Ingest Manager I'll describe how to interpret it. The relevant portion is the Endpoint.policy.applied.actions array. One of them contains a failure (download_user_artifacts), which means the reason your Endpoint is failing to download artifacts it needs from Kibana (since the only artifacts a 7.9 Endpoint uses are exceptionlists it's clear that is the artifact Endpoint cannot download).

The section you'd previously shared a snipped of was from Endpoint.policy.actions.configurations. The way to think of these two sections (actions and configurations) is that when Endpoint applies policy it does many "actions" (e.g. download user artifacts, connect to the kernel driver, etc) for the higher level "configurations" (prevent malware, collect process events, etc). The actions array lists the things Endpoint failed or succeeded in doing, the configurations portion maps those actions to the configurations they are relevant to. Hopefully that makes sense.

Can you look in the Endpoint logs to see why user artifacts are failing to download? The elastic-endpoint.yaml file contains information on the artifacts that are downloaded. If you search for the relative URL (/api/endpoint/artifacts/download/endpoint-exceptionlist-windows-v1) in Endpoint's logs you should hopefully see some log messages that point you to the issue. In this case since you've previously had issues with Kibana connections from Agent I suspect something similar is happening here.

I'm not sure why this failure would cause Endpoint to fail to detect the malware samples you tested. I'd be happy to work through that too but we should get your Endpoint in a good working state before diving into that.