Setting up the Recorded Future integration package. Package installed smoothly and I was setting up feeds for domain, hash, url, ip.
When setting up the url feed, I got an error when clicking Save. Believe it was from choosing the same Integration name as a previously configured feed.
I canceled setup for the new feed. Since that step, when I navigate to the integration and choose Integration Policies, I get a stack trace.
I am able to run configuration for a new feed by choosing "+ Add Recorded Future", but after saving, I also see a stack trace.
Here is a copy of the stack trace:
Error: Cannot read properties of undefined (reading 'agents')
at render (http://172.30.129.161:5601/50668/bundles/plugin/fleet/kibana/fleet.chunk.0.js:18:10692)
at n.value (http://172.30.129.161:5601/50668/bundles/kbn-ui-shared-deps-npm/kbn-ui-shared-deps-npm.dll.js:400:197657)
at http://172.30.129.161:5601/50668/bundles/kbn-ui-shared-deps-npm/kbn-ui-shared-deps-npm.dll.js:400:195107
at Array.forEach (<anonymous>)
at n.value (http://172.30.129.161:5601/50668/bundles/kbn-ui-shared-deps-npm/kbn-ui-shared-deps-npm.dll.js:400:194931)
at http://172.30.129.161:5601/50668/bundles/kbn-ui-shared-deps-npm/kbn-ui-shared-deps-npm.dll.js:400:193806
at Array.map (<anonymous>)
at n.value (http://172.30.129.161:5601/50668/bundles/kbn-ui-shared-deps-npm/kbn-ui-shared-deps-npm.dll.js:400:193699)
at n.value (http://172.30.129.161:5601/50668/bundles/kbn-ui-shared-deps-npm/kbn-ui-shared-deps-npm.dll.js:400:189176)
at n.value (http://172.30.129.161:5601/50668/bundles/kbn-ui-shared-deps-npm/kbn-ui-shared-deps-npm.dll.js:400:188630)
I think your configuration got corrupted somehow, we use two different document (saved objects) to store agent policies and package policy and I think you probably have a package policy referring an agent policy that do not exists anymore.
In the mean time you could probably delete the problematic saved object from the .kibana index (be carefull of what you delete in that index) and use those queries to find the problematic package policy
GET .kibana/_search?q=type:ingest-agent-policies
{
"fields": [],
"_source": false
}
GET .kibana/_search?q=type:ingest-package-policies
{
"fields": [
"ingest-package-policies.policy_id"
],
"_source": false
}
It turned out to be OK for me to delete all existing agent policies as we're still standing this cluster up. I deleted all agent policies. Your first query shows no hits:
Thank you @nchaulet ! I was able to delete the non-existent agent policy with this command. Very helpful. For reference for anyone visiting this thread I had to delete it with a user with the following role:
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.