Modify ID of an installed agent

Elastic Security SIEM
1

*Good afternoon!

I wanted to know if it is possible to change the ID of an agent once installed, the problem it would be presenting is that when cloning a VM the agent remains installed and with the ID the base machine, although it sends the events to the Fleet I only see one agent , which alternates its description between the original MV and the cloned MV, there is a possibility of modifying that ID

Thank you so much*

2

To change the agent id you would need to reenroll it using the enroll command.

Or you can also use the install command with the -f argument to force it to overwrite the current config.

Are you cloning a random VM or do you have an VM image that you use to create other VMs?

If you have an image you could install the agent using the --delay-enroll argument as explained in the documentation.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.