# New "Elastic Defend" integration not recognized by rules (8.6.2)

**URL:** <https://discuss.elastic.co/t/new-elastic-defend-integration-not-recognized-by-rules-8-6-2/326436>\
**Category:** Endpoint Security\
**Created:** [February 24, 2023, 11:59am UTC](https://discuss.elastic.co/t/new-elastic-defend-integration-not-recognized-by-rules-8-6-2/326436 "2023-02-24T11:59:09Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![syk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/syk/32/141533_2.png) [@syk](https://discuss.elastic.co/u/syk)\
**Post date:** [February 24, 2023, 11:59am UTC](https://discuss.elastic.co/t/new-elastic-defend-integration-not-recognized-by-rules-8-6-2/326436/1 "2023-02-24T11:59:09Z")

</div>

Hi,

I'm not able to satisfy the dependency of the "Prebuilt Security Detection Rules" on a fresh installation (on premises) of Elastic and Kibana version 8.6.2:  
Rules demand "_ **Endpoint Security** _" integration being installed - but that is deprected and superseded by the "_ **Elastic Defend** _" integration. (If you browse available integrations for "_endpoint_" only the new one shows up...)

I've already deleted all integrations from all policies, added the deprecated one first and then upgraded to the new integration -\> no success  
Reinstalling the "Prebuilt Security Detection Rules" also didn't do the trick

Installed integrations ("Elastic Defend" which should be version 8.6.1 of "Endpoint"):

 ![installed_integrations](https://us1.discourse-cdn.com/elastic/original/3X/f/d/fd9bf1a1d2208fa330e6cc3a14a178f1a41cadfe.jpeg)

Missing integrations (there are many rules demanding "Endpoint" being installed):

 ![rules_missing_integrations](https://us1.discourse-cdn.com/elastic/original/3X/3/8/38435f970fe6f0423054704306c7b72fb88ddcdb.jpeg)

One example for a rule damanding the "old" integration:

 ![example_dependency](https://us1.discourse-cdn.com/elastic/original/3X/4/a/4a6995492ad94c1142da21c3a6685f3acc9c1c1c.jpeg)

Another example: rule "_Endpoint Security_" (the warning about a missing index is NOT my issue here):

 ![related_not_installed](https://us1.discourse-cdn.com/elastic/original/3X/e/e/ee88166ae706f8177183dc13006e839eb088543a.jpeg)

Following the link to the missing integration (screenshot above) I get the option to add the old deprecated "_Endpoint Security_"... (which I tried to add and then upgrade - but that didn't resolve the problem):

 ![Endpoint_Security](https://us1.discourse-cdn.com/elastic/original/3X/7/4/7446b7af6da2a23555d6e52f1999ada1b27a5d9f.jpeg)

any ideas?  
kind regards, syk

---

<div class="post-metadata">

**Author:** ![Kelly\_Slavens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kelly_slavens/32/12134_2.png) [@Kelly\_Slavens](https://discuss.elastic.co/u/Kelly_Slavens)\
**Post date:** [February 24, 2023, 2:46pm UTC](https://discuss.elastic.co/t/new-elastic-defend-integration-not-recognized-by-rules-8-6-2/326436/2 "2023-02-24T14:46:21Z")

</div>

We're seeing the same thing. I posted just yesterday on it as well.

> [@Alert rules requiring endpoint integration 8.2.0 when 8.6.1 is installed already](https://discuss.elastic.co/t/alert-rules-requiring-endpoint-integration-8-2-0-when-8-6-1-is-installed-already/326219):
>
> We're seeing an issue in the Rules section. Several rules indicate they require the Endpoint Integration to be installed. Endpoint is installed and deployed on thousands of devices. The link provided points to version 8.2.0 and older version. We are running 8.6.1 with the 8.6.1 endpoint defense integration installed and upgrade. Anyone else seeing the rules indicate it thinks endpoint is not installed and recommends an older 8.2.0 version? [image]

---

<div class="post-metadata">

**Author:** ![wsouza](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wsouza/32/92547_2.png) [@wsouza](https://discuss.elastic.co/u/wsouza)\
**Post date:** [February 24, 2023, 3:06pm UTC](https://discuss.elastic.co/t/new-elastic-defend-integration-not-recognized-by-rules-8-6-2/326436/3 "2023-02-24T15:06:57Z")

</div>

I just replied to the post @Kelly_Slavens

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 24, 2023, 3:07pm UTC](https://discuss.elastic.co/t/new-elastic-defend-integration-not-recognized-by-rules-8-6-2/326436/4 "2023-03-24T15:07:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.