MS Defender for Endpoint integration

Elastic Stack Elastic Agent
1

After upgrading to 8.19.2, the MS Defender for Endpoint integration said Reauthorization required. It worked fine before the upgrade.

reauthorizarion_required
reauthorizarion_required423×130 6.83 KB

When I click on that integration and then click on the Assets tab, it says the installation has been deferred and wants a Transforms reauthorized.

integration
integration1584×454 37.8 KB

When I click the Reauthorize or the Reauthorize all buttons or the it fails.

authorize0
authorize0325×111 6.13 KB

When I look at the details of the elastic agent using that integration, it shows this

httpjson
httpjson791×277 32.5 KB

Any pointers to what the issue may be would be appreciated.

Thank you,

Brad

2

I removed the integration from the agent policy and then re-added it and it seems to have solved the Inputs issue

integration2
integration2766×124 5.77 KB

However, the reauthorization issue remains. I’m wondering if it could be related to this issue.
m365_defender,microsoft_defender_endpoint}: Add mapping and transform for CDR workflows

3

Just to follow up in case anyone else runs into this issue. I submitted a support ticket to Elastic and sent a bunch of diagnostic files they worked on it for a few weeks but before they could provide a fix, I upgraded to the latest version 4.0.0 and the issue was resolved. I had upgraded the integration a couple times since the issue first started but those didn’t solve it.