# Integration
**URL:** https://discuss.elastic.co/t/integration/326744
**Category:** Endpoint Security
**Created:** [March 1, 2023, 9:52am UTC](https://discuss.elastic.co/t/integration/326744 "2023-03-01T09:52:33Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@bex](https://discuss.elastic.co/u/bex)
#### Post date: [March 1, 2023, 9:52am UTC](https://discuss.elastic.co/t/integration/326744/1 "2023-03-01T09:52:33Z")
I would like to clarify, what is the difference between "EndPoint Security" and "Elastic Defend" integrations?
But there is only "Elastic Defend" in "integration" tab. But in "rules", it is asked to add "Endpoint security"
---
### Author:  [@Sebastian\_Huettersen](https://discuss.elastic.co/u/Sebastian_Huettersen)
#### Post date: [March 1, 2023, 8:28pm UTC](https://discuss.elastic.co/t/integration/326744/2 "2023-03-01T20:28:31Z")
Hey @bex ,
its the same it was renamed in:
[8.5 | Elastic Security Solution [8.6] | Elastic](https://www.elastic.co/guide/en/security/current/release-notes-header-8.5.0.html#release-notes-8.5.0)
- Renames the Elastic Endpoint and Cloud Security integration to the Elastic Defend integration ([#139517](https://github.com/elastic/kibana/pull/139517)).
Regards
Sebastian
---
### Author:  [@bex](https://discuss.elastic.co/u/bex)
#### Post date: [March 2, 2023, 4:56am UTC](https://discuss.elastic.co/t/integration/326744/3 "2023-03-02T04:56:58Z")
Hello Sebastian. Thanks for reply.
Do you know why it shows that integration is not installed, although I have installed Elastic Defend. And when I want to add "Endpoint Security" integration to the policy, it does not allow me to install it, since there is already "Elastic Defend"
---
### Author:  [@Sebastian\_Huettersen](https://discuss.elastic.co/u/Sebastian_Huettersen)
#### Post date: [March 2, 2023, 7:22am UTC](https://discuss.elastic.co/t/integration/326744/4 "2023-03-02T07:22:31Z")
Hello @bex ,
I would check the following things:
1. Was the integration also rolled out via an [Elastic Agent Policy](https://www.elastic.co/guide/en/fleet/8.6/agent-policy.html). If not then role this out.
2. If this integration was rolled out then I would check if the agent can communicate with the elasticsearch.
As you can see in your error message from image 1, this role would currently run into the void because there is currently no data from Elastic defend in elasticsearch.
Regards,
Sebastian
---
### Author:  [@bex](https://discuss.elastic.co/u/bex)
#### Post date: [March 3, 2023, 5:51am UTC](https://discuss.elastic.co/t/integration/326744/5 "2023-03-03T05:51:49Z")
Hello @Sebastian_Huettersen
Thanks for reply.
1. Yes, the integration was rolled out via an Elastic Agent policy.
2. Yes, agent can communicate with the elasticsearch. Elasticsearch receives logs from elastic agents and I can see them. In the "fleet" section, everything is fine with the status of agents.
The only thing that I have disabled, the "collect agent metrics"
---
### Author:  [@Sebastian\_Huettersen](https://discuss.elastic.co/u/Sebastian_Huettersen)
#### Post date: [March 3, 2023, 6:14am UTC](https://discuss.elastic.co/t/integration/326744/6 "2023-03-03T06:14:22Z")
Hello @bex
I have looked at your screenshots again. There I noticed that one of the rule has worked.
Currently, there is a display bug for endpoint:
>
>
> First reported in \`8.6.1\`, but also reproduced in \`8.5.0\`, the \`Elastic Defend\` …or \`Endpoint\` integration will show as \`Not installed\` when it is in fact installed.
>
> \
> \
> \
>
>
>
> Debugging this, we can work our way back from the client since it appears the \`detection\_engine/fleet/integrations/installed\` API is returning back that it's actually installed.
>
> Here we determine if the integration is \`installed\` by seeing if the related integration from the Rule is within the list of installed packages returned by fleet. The package name check ends up being truthy, however the integration name check fails since the rule doesn't provide an related integration name (since there isn't one for \`Elastic Defend\`), yet the our data model is including integration details with an \`''\` integration\_name.
>
> https://github.com/elastic/kibana/blob/21de750b3cff4d4ad27d07c77135327e644b3bee/x-pack/plugins/security\_solution/public/detections/components/rules/related\_integrations/integration\_details.ts#L81-L84
>
> Now heading to the server, we set the \`integration\_name\` from the \`policy.input\[\].policy\_template\`, however this is undefined for the \`Elastic Defend\` integration, and so ends up as emptystring \`''\`.
> https://github.com/elastic/kibana/blob/21de750b3cff4d4ad27d07c77135327e644b3bee/x-pack/plugins/security\_solution/server/lib/detection\_engine/fleet\_integrations/api/get\_installed\_integrations/installed\_integration\_set.ts#L129
>
> As a result, when determining if we need to augment the package with integration details, we now have a mismatch between \`packageInfo.package\_name\` & \`integrationInfo.integration\_name\`, which results in us adding integration details, but with an invalid \`integration\_name\`.
> https://github.com/elastic/kibana/blob/21de750b3cff4d4ad27d07c77135327e644b3bee/x-pack/plugins/security\_solution/server/lib/detection\_engine/fleet\_integrations/api/get\_installed\_integrations/installed\_integration\_set.ts#L88
>
> which is why the client is determining that the integration is not installed.
>
> So looks like the root cause here is that there's no \`policy\_template\` being returned on the packagePolicies' \`input\` object for the \`Elastic Defend\` integration:
>
> \
> \
> \
>
> We can see this directly with the \`/kbn/api/fleet/package\_policies\` fleet API as well:
>
> \##### Elastic Defend integration on the left, Fleet Server integration on the right:
> \
\
>
> \---
>
> I haven't found any specific fleet/package-registry changes yet that would explain why the \`Elastic Defend\` packagePolicies don't include a \`policy\_template\` (maybe it happened as part of the refactor from Elastic Security -\> Elastic Defend?), so if not a change introduced in the interim, perhaps we missed this in our initial testing @banderror?
>
> Either way, looks like we can either use the root \`input.type\` or the nested \`config.integration\_config.type\` off of the packagePolicy if the \`policy\_template\` isn't present. Will need to test with lone packages and packages+integrations to see the behavior here.
I guess that the one rule does not work because there have been no alerts from the Elastic defend so far.
---
### Author:  [@bex](https://discuss.elastic.co/u/bex)
#### Post date: [March 3, 2023, 6:44am UTC](https://discuss.elastic.co/t/integration/326744/7 "2023-03-03T06:44:06Z")
as I understand, what shows as "not installed" is a bug, right? But from [[Security Solution]Endpoint security rule has wrong Related integrations information. · Issue #151103 · elastic/kibana · GitHub](https://github.com/elastic/kibana/issues/151103), we see that the bug was fixed for version 8.7.
If I'm not mistaken, version 8.7 has not been released for production yet?
---
### Author:  [@Sebastian\_Huettersen](https://discuss.elastic.co/u/Sebastian_Huettersen)
#### Post date: [March 3, 2023, 6:46am UTC](https://discuss.elastic.co/t/integration/326744/8 "2023-03-03T06:46:36Z")
Latest production version is [Elasticsearch version 8.6.2 | Elasticsearch Guide [8.6] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/release-notes-8.6.2.html)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 31, 2023, 6:47am UTC](https://discuss.elastic.co/t/integration/326744/9 "2023-03-31T06:47:20Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.