# No alert in security detection dashboards after malware attack

**URL:** <https://discuss.elastic.co/t/no-alert-in-security-detection-dashboards-after-malware-attack/258380>\
**Category:** Endpoint Security\
**Tags:** elastic-agent\
**Created:** [December 11, 2020, 7:52am UTC](https://discuss.elastic.co/t/no-alert-in-security-detection-dashboards-after-malware-attack/258380 "2020-12-11T07:52:02Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Diana\_Dragoiu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/diana_dragoiu/32/78541_2.png) [@Diana\_Dragoiu](https://discuss.elastic.co/u/Diana_Dragoiu)\
**Post date:** [December 11, 2020, 7:52am UTC](https://discuss.elastic.co/t/no-alert-in-security-detection-dashboards-after-malware-attack/258380/1 "2020-12-11T07:52:03Z")

</div>

Hello ES team,  
After installing and enrolling Elastic Agent 7.10 we launched an Mimikatz.exe on our Win10 machine and received an ES Malware Alert but we do not receive an alert in Security Detections tab in Kibana. The rule: Malware - Detected - Endpoint Security was activated and can't be edited.

In Security-\>Administration tab there are no Endpoints enrolled.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/d/5d27a1913d81629e8c129f0b8f8a0c7d3832fef8.png)

In Data streams tab the elastic\_agent.endpoint-security is not integrated to endpoint.

 ![endpoint_integration](https://us1.discourse-cdn.com/elastic/original/3X/c/1/c1175521b17e1a183c5252ce1722793ff8777573.png)  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/e/1e4b4bec8a8f3fb6beb567c5769603e7ee78d71c.png)

We tried to recreate the case(link) as bellow but no alert is shown -\> [https://newtonpaul.com/how-to-install-elastic-siem-and-elastic-edr/#Installing\_Elastic\_EDR\_SIEM](https://newtonpaul.com/how-to-install-elastic-siem-and-elastic-edr/#Installing_Elastic_EDR_SIEM)

We enrolled the agent using a CA self signed certificate using:  
.\elastic-agent.exe enroll [https://x.x.x.x:5601](https://x.x.x.x:5601) a2kzelJuWUJsSUFCcjI3UHBaYVc6ekdkUW1YMVFUVldHQnNnWXBMLW9wZw== -a 'C:\Program Files\Elastic\Agent\ca.crt'

The .yml files are below:  
elastic-agent.yml

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/a/8a598f4d9cd5237ac9dde76742fd51b741e47ddd.png)

elastic-endpoint.yml

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/b/bb8dea0fadcd78b91d2b39d2e662cf051a041635.png)  
fleet.yml  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/b/6bb5c1ef0c20884ef3777d8a02f698337a8fb814.png)

Could you be so kind and help me?

Thank you!

---

<div class="post-metadata">

**Author:** ![ferullo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ferullo/32/74240_2.png) [@ferullo](https://discuss.elastic.co/u/ferullo)\
**Post date:** [December 14, 2020, 4:53pm UTC](https://discuss.elastic.co/t/no-alert-in-security-detection-dashboards-after-malware-attack/258380/2 "2020-12-14T16:53:02Z")

</div>

Hi @Diana_Dragoiu

It seems like your issue might be that Elastic Endpoint is not able to send data to Elasticsearch from the information you provide (thanks for it all!). It appears Endpoint is working it just can't tell Kibana it is working.

Could you look in the Endpoint logs to see what might be happening? On Windows Endpoint logs are placed in `c:\Program Files\Elastic\Endpoint\state\log\endpoint-*.log`

A few log messages to search for are `No valid comms client available`, `Dropping rejected document`, `Elasticsearch connection is down`, and `Sent XXX documents to Elasticsearch` (where `XXX` is a number that changes per log message, I'd expect it to be `0` in all cases for you but if it's not that would be interesting). When those logs appear the messages before and after would also be interesting to know. In particular just before some of those messages appear you will probably see messages related to the HTTP session in use. That should help us narrow down why Endpoint is not putting data into Elasticsearch.

---

<div class="post-metadata">

**Author:** ![Diana\_Dragoiu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/diana_dragoiu/32/78541_2.png) [@Diana\_Dragoiu](https://discuss.elastic.co/u/Diana_Dragoiu)\
**Post date:** [December 15, 2020, 8:18am UTC](https://discuss.elastic.co/t/no-alert-in-security-detection-dashboards-after-malware-attack/258380/3 "2020-12-15T08:18:02Z")

</div>

Hello @ferullo,  
Thank you for your reply.

From last endpoint-\*.log I get the following line(ordered):

Elasticsearch connection is down:

 ![last_lines0](https://us1.discourse-cdn.com/elastic/original/3X/8/f/8f5b8085fc9455ca76b594a77207f7339d156396.png)  
ssl.params not found:  
 ![last1](https://us1.discourse-cdn.com/elastic/original/3X/9/9/99b825d082599c19fdc1248fccaeafab76e64436.png)  
ssl problem. Unable to get the ssl issuer:  
 ![elastic_connection_down2](https://us1.discourse-cdn.com/elastic/original/3X/9/6/960c22524f98648e09155c617ae86bbe9568235a.png)

Agent issues:  
One day before:

 ![agent](https://us1.discourse-cdn.com/elastic/original/3X/f/1/f14cbe098b02f022368dcc9ae6530b9316b2626d.png)  
At this moment from Services:  
 ![elastic-agent_service](https://us1.discourse-cdn.com/elastic/original/3X/3/d/3d6287d471c9011f815b0baebe836e00ca142d40.png)

My thoughts are that because of the ca.crt self signed certificate is this problem.

From the link( [https://newtonpaul.com/how-to-install-elastic-siem-and-elastic-edr/#Installing\_Elastic\_EDR\_SIEM](https://newtonpaul.com/how-to-install-elastic-siem-and-elastic-edr/#Installing_Elastic_EDR_SIEM)) I have done:

Imported ca.crt here -\> Trusted Root Certification Authorities \> Certificates  
Set the local policy : Security Settings \> Public Key Policies \> Certificate Path Validation Settings.  
Enrolled the agent with the following option : -a 'C:\Program Files\Elastic\Agent\ca.crt'

elastic-endpoint.yaml complete:

 ![elastic-endpoint.yaml_first](https://us1.discourse-cdn.com/elastic/original/3X/3/2/32fa2b2b95d99071da8e7759f9c606d68276b065.png)  
 ![elastic-endpoint.yaml_last](https://us1.discourse-cdn.com/elastic/original/3X/2/8/28cfeb62826854851dfddef626f58f0ac6c3bf16.png)

Your help is appreciated. And we are planning to use the Agent in the future in Production. Any estimated date when the agent will move from beta state?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [December 15, 2020, 7:45pm UTC](https://discuss.elastic.co/t/no-alert-in-security-detection-dashboards-after-malware-attack/258380/4 "2020-12-15T19:45:26Z")

</div>

Please don't post pictures of text, they are difficult to read, impossible to search and replicate (if it's code), and some people may not be even able to see them 🙂

---

<div class="post-metadata">

**Author:** ![Diana\_Dragoiu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/diana_dragoiu/32/78541_2.png) [@Diana\_Dragoiu](https://discuss.elastic.co/u/Diana_Dragoiu)\
**Post date:** [December 16, 2020, 5:33am UTC](https://discuss.elastic.co/t/no-alert-in-security-detection-dashboards-after-malware-attack/258380/5 "2020-12-16T05:33:50Z")

</div>

Hello @warkolm,

Sorry about that. Did not know.  
So I'll post some text from endpoint\*.log:  
tp.cpp"}}},"message":"Http.cpp:38 CURL error 60: Error [SSL certificate problem: unable to get local issuer certificate]","process":{"pid":10012,"thread":{"id":3828}}}  
{"@timestamp":"2020-12-11T00:44:18.5332287Z","agent":{"id":"5b05aef9-fc59-0d88-f268-461975e80fae","type":"endpoint"},"ecs":{"version":"1.5.0"},"log":{"level":"notice","origin":{"file":{"line":84,"name":"BulkQueueConsumer.cpp"}}},"message":"BulkQueueConsumer.cpp:84 Elasticsearch connection is down","process":{"pid":10012,"thread":{"id":3828}}}

CURL error 60: Error [SSL certificate problem: unable to get local issuer certificate]","process":{"pid":592,"thread":{"id":1384}}}  
{"@timestamp":"2020-12-09T14:54:55.0468446Z","agent":{"id":"93924273-5e90-c21c-3748-ec0f2c92b9e8","type":"endpoint"},"ecs":{"version":"1.5.0"},"log":{"level":"notice","origin":{"file":{"line":84,"name":"BulkQueueConsumer.cpp"}}},"message":"BulkQueueConsumer.cpp:84 Elasticsearch connection is down","process":{"pid":592,"thread":{"id":1384}}}  
{"@timestamp":"2020-12-09T14:54:55.1093331Z","agent":{"id":"93924273-5e90-c21c-3748-ec0f2c92b9e8","type":"endpoint"},"ecs":{"version":"1.5.0"},"log":{"level":"info","origin":{"file":{"line":83,"name":"AgentConnectionInfo.cpp"}}},"message":"AgentConnectionInfo.cpp:83 Failed to find connection to validate. Is Agent listening on 127.0.0.1:6788?","process":{"pid":592,"thread":{"id":2080}}}  
{"@timestamp":"2020-12-09T14:54:55.1093331Z","agent":{"id":"93924273-5e90-c21c-3748-ec0f2c92b9e8","type":"endpoint"},"ecs":{"version":"1.5.0"},"log":{"level":"error","origin":{"file":{"line":107,"name":"AgentConnectionInfo.cpp"}}},"message":"AgentConnectionInfo.cpp:107 Agent process is not root/admin or validation failed, disconnecting","process":{"pid":592,"thread":{"id":2080}}}  
{"@timestamp":"2020-12-09T14:54:55.1093331Z","agent":{"id":"93924273-5e90-c21c-3748-ec0f2c92b9e8","type":"endpoint"},"ecs":{"version":"1.5.0"},"log":{"level":"warning","origin":{"file":{"line":164,"name":"AgentConnectionInfo.cpp"}}},"message":"AgentConnectionInfo.cpp:164 Failed to established stage 1 connection to agent","process":{"pid":592,"thread":{"id":2080}}}  
{"@timestamp":"2020-12-09T14:54:55.1093331Z","agent":{"id":"93924273-5e90-c21c-3748-ec0f2c92b9e8","type":"endpoint"},"ecs":{"version":"1.5.0"},"log":{"level":"error","origin":{"file":{"line":538,"name":"AgentComms.cpp"}}},"message":"AgentComms.cpp:538 Unable to retrieve connection info from Agent(Agent is not running as root)","process":{"pid":592,"thread":{"id":2080}}}  
{"@timestamp":"2020-12-09T14:55:00.0468855Z","agent":{"id":"93924273-5e90-c21c-3748-ec0f2c92b9e8","type":"endpoint"},"ecs":{"version":"1.5.0"},"log":{"level":"info","origin":{"file":{"line":1442,"name":"HttpLib.cpp"}}},"message":"HttpLib.cpp:1442 Establishing GET connection to [[https://192.168.224.10:9200/\_cluster/health](https://192.168.224.10:9200/_cluster/health)]","process":{"pid":592,"thread":{"id":1384}}}  
{"@timestamp":"2020-12-09T14:55:00.0468855Z","agent":{"id":"93924273-5e90-c21c-3748-ec0f2c92b9e8","type":"endpoint"},"ecs":{"version":"1.5.0"},"log":{"level":"error","origin":{"file":{"line":38,"name":"Http.cpp"}}},"message":"Http.cpp:38 CURL error 60: Error [SSL certificate problem: unable to get local issuer certificate]","process":{"pid":592,"thread":{"id":1384}}}  
{"@timestamp":"2020-12-09T14:55:00.0468855Z","agent":{"id":"93924273-5e90-c21c-3748-ec0f2c92b9e8","type":"endpoint"},"ecs":{"version":"1.5.0"},"log":{"level":"notice","origin":{"file":{"line":84,"name":"BulkQueueConsumer.cpp"}}},"message":"BulkQueueConsumer.cpp:84 Elasticsearch connection is down","process":{"pid":592,"thread":{"id":1384}}}  
{"@timestamp":"2020-12-09T14:55:01.1094495Z","agent":{"id":"93924273-5e90-c21c-3748-ec0f2c92b9e8","type":"endpoint"},"ecs":{"version":"1.5.0"},"log":{"level":"info","origin":{"file":{"line":83,"name":"AgentConnectionInfo.cpp"}}},"message":"AgentConnectionInfo.cpp:83 Failed to find connection to validate. Is Agent listening on 127.0.0.1:6788?"

Regards,  
Diana

---

<div class="post-metadata">

**Author:** ![Nick\_Berlin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nick_berlin/32/74426_2.png) [@Nick\_Berlin](https://discuss.elastic.co/u/Nick_Berlin)\
**Post date:** [December 16, 2020, 8:46pm UTC](https://discuss.elastic.co/t/no-alert-in-security-detection-dashboards-after-malware-attack/258380/6 "2020-12-16T20:46:09Z")

</div>

Hello @Diana_Dragoiu,

I'm not sure if `C:\Program Files\Elastic\Agent\ca.crt` is the same certificate authority that is generated by the elasticsearch instance. Can you confirm that?

The ElasticEndpoint makes a direct connection to elasticsearch and according to the logs above it's failing to do so because it cannot find the proper certificate authority in the host's trusted root certificates.

Please ensure the certificate authority from elasticsearch is installed and that ElasticEndpoint service be stopped and started after doing so.

Here's a [link](https://discuss.elastic.co/t/endpoints-are-enrolling-stuck-message/258599/7) to steps I used to get a Windows 10 ElasticEndpoint connected to elasticsearch.

Sure hope this helps.

---

<div class="post-metadata">

**Author:** ![Diana\_Dragoiu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/diana_dragoiu/32/78541_2.png) [@Diana\_Dragoiu](https://discuss.elastic.co/u/Diana_Dragoiu)\
**Post date:** [December 17, 2020, 7:24am UTC](https://discuss.elastic.co/t/no-alert-in-security-detection-dashboards-after-malware-attack/258380/7 "2020-12-17T07:24:09Z")

</div>

Hello @Nick_Berlin,

Finally it works. I have installed the ca.crt before as User not Local Machine and I added the ca.crt certificate that already worked for Kibana.

Many thanks to you and your team !

---

<div class="post-metadata">

**Author:** ![Nick\_Berlin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nick_berlin/32/74426_2.png) [@Nick\_Berlin](https://discuss.elastic.co/u/Nick_Berlin)\
**Post date:** [December 17, 2020, 3:01pm UTC](https://discuss.elastic.co/t/no-alert-in-security-detection-dashboards-after-malware-attack/258380/8 "2020-12-17T15:01:17Z")

</div>

Excellent, glad it's working. Thanks for the feedback about User vs Local Machine.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 14, 2021, 3:01pm UTC](https://discuss.elastic.co/t/no-alert-in-security-detection-dashboards-after-malware-attack/258380/9 "2021-01-14T15:01:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.