Healthy agents not appearing in endpoint security

Elastic Security
1

I'm having issues finding any information on this... I've seen similar posts, but i see that they've been closed out due to no response... I have a healthy agent on a windows host that is able to successfully enroll into my fleet. However, I do not see it appear in the Elastic Security endpoints section. Everything was working fine about 3 months ago. Anyone able to help? TIA

.\elastic-agent.exe status
Status: HEALTHY
Message: (no message)
Applications:
  * metricbeat             (HEALTHY)
                           Running
  * filebeat               (HEALTHY)
                           Running
  * filebeat_monitoring    (HEALTHY)
                           Running
  * metricbeat_monitoring  (HEALTHY)
                           Running

I've gone into index management and searched for endpoint and I do see things listed. (not sure why my health is yellow)

image
image1668×757 82.1 KB

2

Hi @eric10 . It doesn't look like you have Elastic Defend added to the Agent you shared details about. Only Agent's with the Elastic Defend integration will appear in the Security App's Endpoints page. Was it removed at some point by accident?

3

I realized I grabbed the wrong screenshot after re-installing the agent a handful of times. Endpoint security does appear as part of the integration when running elastic-agent status.

I did end up resolving my issue... Hopefully I can save people some time if they run into this post.... If you're installing elastic-agent on a windows machine, make sure you actually right click that certificate and do the install cert option. I also encountered this on ubuntu. I didn't have any issues installing the agent with CA certs on RHEL machines or windows servers.

4

I feel like my results on this issue are pretty inconsistent.... I've started to use the --insecure flag to try to rule things out and i'm getting some Windows machines and now Linux machines enrolling just fine, while others are not. It's appearing in the Fleet section. But it's not appearing in Security Endpoints or in Security Hosts.

This screenshot is of an install on Fedora. Correct Policy was chosen.

image
image705×293 7.88 KB

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.