# Recorded Future Integration Package Setup Stack Traces

**URL:** https://discuss.elastic.co/t/recorded-future-integration-package-setup-stack-traces/303559
**Category:** Kibana
**Tags:** integrations
**Created:** [April 28, 2022, 11:18pm UTC](https://discuss.elastic.co/t/recorded-future-integration-package-setup-stack-traces/303559 "2022-04-28T23:18:04Z")
**Posts on this page:** 9
**Page:** 1

<div class="post-metadata">

### Author: ![codewriterguy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/codewriterguy/32/113440_2.png) [@codewriterguy](https://discuss.elastic.co/u/codewriterguy)
#### Post date: [April 28, 2022, 11:18pm UTC](https://discuss.elastic.co/t/recorded-future-integration-package-setup-stack-traces/303559/1 "2022-04-28T23:18:04Z")

</div>

Setting up the Recorded Future integration package. Package installed smoothly and I was setting up feeds for domain, hash, url, ip.

When setting up the url feed, I got an error when clicking Save. Believe it was from choosing the same Integration name as a previously configured feed.

I canceled setup for the new feed. Since that step, when I navigate to the integration and choose Integration Policies, I get a stack trace.

I am able to run configuration for a new feed by choosing "+ Add Recorded Future", but after saving, I also see a stack trace.

Here is a copy of the stack trace:

```auto
Error: Cannot read properties of undefined (reading 'agents')
    at render (http://172.30.129.161:5601/50668/bundles/plugin/fleet/kibana/fleet.chunk.0.js:18:10692)
    at n.value (http://172.30.129.161:5601/50668/bundles/kbn-ui-shared-deps-npm/kbn-ui-shared-deps-npm.dll.js:400:197657)
    at http://172.30.129.161:5601/50668/bundles/kbn-ui-shared-deps-npm/kbn-ui-shared-deps-npm.dll.js:400:195107
    at Array.forEach (<anonymous>)
    at n.value (http://172.30.129.161:5601/50668/bundles/kbn-ui-shared-deps-npm/kbn-ui-shared-deps-npm.dll.js:400:194931)
    at http://172.30.129.161:5601/50668/bundles/kbn-ui-shared-deps-npm/kbn-ui-shared-deps-npm.dll.js:400:193806
    at Array.map (<anonymous>)
    at n.value (http://172.30.129.161:5601/50668/bundles/kbn-ui-shared-deps-npm/kbn-ui-shared-deps-npm.dll.js:400:193699)
    at n.value (http://172.30.129.161:5601/50668/bundles/kbn-ui-shared-deps-npm/kbn-ui-shared-deps-npm.dll.js:400:189176)
    at n.value (http://172.30.129.161:5601/50668/bundles/kbn-ui-shared-deps-npm/kbn-ui-shared-deps-npm.dll.js:400:188630)

```

Here is a screenshot of the problematic tab:

 ![Screen Shot 2022-04-28 at 5.16.44 PM](https://us1.discourse-cdn.com/elastic/original/3X/2/3/23539577c9e0803aa7a6a9af57d6c6bca20b194e.png)

---

<div class="post-metadata">

### Author: ![nchaulet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nchaulet/32/77896_2.png) [@nchaulet](https://discuss.elastic.co/u/nchaulet)
#### Post date: [May 10, 2022, 2:31pm UTC](https://discuss.elastic.co/t/recorded-future-integration-package-setup-stack-traces/303559/2 "2022-05-10T14:31:09Z")

</div>

Hi @codewriterguy

I think your configuration got corrupted somehow, we use two different document (saved objects) to store agent policies and package policy and I think you probably have a package policy referring an agent policy that do not exists anymore.

I created a bug ticket in Kibana so we can have a better experience for that [[Fleet] Do not crash when a package policy refer a non existing agent policy · Issue #131928 · elastic/kibana · GitHub](https://github.com/elastic/kibana/issues/131928)

In the mean time you could probably delete the problematic saved object from the `.kibana` index (be carefull of what you delete in that index) and use those queries to find the problematic package policy

```auto
GET .kibana/_search?q=type:ingest-agent-policies
{
  "fields": [],
  "_source": false
}

GET .kibana/_search?q=type:ingest-package-policies
{
  "fields": [
    "ingest-package-policies.policy_id"
  ],
  "_source": false
}

```

Let me know if it work for you

---

<div class="post-metadata">

### Author: ![codewriterguy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/codewriterguy/32/113440_2.png) [@codewriterguy](https://discuss.elastic.co/u/codewriterguy)
#### Post date: [May 11, 2022, 11:09pm UTC](https://discuss.elastic.co/t/recorded-future-integration-package-setup-stack-traces/303559/3 "2022-05-11T23:09:51Z")

</div>

Thank you for filing a bug ticket on this! I will take a look with these queries and see what I can do, and report back here

---

<div class="post-metadata">

### Author: ![codewriterguy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/codewriterguy/32/113440_2.png) [@codewriterguy](https://discuss.elastic.co/u/codewriterguy)
#### Post date: [May 17, 2022, 9:24pm UTC](https://discuss.elastic.co/t/recorded-future-integration-package-setup-stack-traces/303559/4 "2022-05-17T21:24:17Z")

</div>

It turned out to be OK for me to delete all existing agent policies as we're still standing this cluster up. I deleted all agent policies. Your first query shows no hits:

```auto
{
  "hits" : {
    "total" : {
      "value" : 0,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : []
  }
}

```

I still can't delete the integration package though. "Uninstall Recorded Future" is grayed out in Integrations -\> Recorded Future -\> Settings

The second query shows 1 hit with no policy ID:

```auto
  "hits" : {
    "total" : {
      "value" : 1,
      "relation" : "eq"
    },
    "max_score" : 7.779048,
    "hits" : [
      {
        "_index" : ".kibana_8.1.2_001",
        "_id" : "ingest-package-policies:c80f1a4a-7b5b-4f20-971c-8d9c350563a5",
        "_score" : 7.779048,
        "fields" : {
          "ingest-package-policies.policy_id" : [
            ""
          ]
        }
      }
    ]
  }

```

---

<div class="post-metadata">

### Author: ![codewriterguy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/codewriterguy/32/113440_2.png) [@codewriterguy](https://discuss.elastic.co/u/codewriterguy)
#### Post date: [May 17, 2022, 9:25pm UTC](https://discuss.elastic.co/t/recorded-future-integration-package-setup-stack-traces/303559/5 "2022-05-17T21:25:12Z")

</div>

I did also restart ES + Kibana services after removing all agent policies

---

<div class="post-metadata">

### Author: ![codewriterguy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/codewriterguy/32/113440_2.png) [@codewriterguy](https://discuss.elastic.co/u/codewriterguy)
#### Post date: [May 17, 2022, 9:27pm UTC](https://discuss.elastic.co/t/recorded-future-integration-package-setup-stack-traces/303559/6 "2022-05-17T21:27:15Z")

</div>

This is interesting, Management -\> Fleet shows no agent policies but Management -\> Integrations -\> Recorded Future shows 1 agent policy

 ![Screen Shot 2022-05-17 at 3.25.50 PM](https://us1.discourse-cdn.com/elastic/original/3X/a/0/a06bc6b33f58d4678130fff22a4815c0772bc9dd.png)

 ![Screen Shot 2022-05-17 at 3.26.53 PM](https://us1.discourse-cdn.com/elastic/original/3X/8/c/8c78b0a2e27b32a6ad25329424ac1daa4b53ef96.png)

---

<div class="post-metadata">

### Author: ![nchaulet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nchaulet/32/77896_2.png) [@nchaulet](https://discuss.elastic.co/u/nchaulet)
#### Post date: [May 24, 2022, 1:26pm UTC](https://discuss.elastic.co/t/recorded-future-integration-package-setup-stack-traces/303559/7 "2022-05-24T13:26:07Z")

</div>

Hi @codewriterguy it seems that there is an orphaned package policy that will need to be deleted

You could probably do so with the following query

```auto
DELETE .kibana/_doc/ingest-package-policies:c80f1a4a-7b5b-4f20-971c-8d9c350563a5

```

Let me know if it helped

---

<div class="post-metadata">

### Author: ![codewriterguy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/codewriterguy/32/113440_2.png) [@codewriterguy](https://discuss.elastic.co/u/codewriterguy)
#### Post date: [May 25, 2022, 9:52pm UTC](https://discuss.elastic.co/t/recorded-future-integration-package-setup-stack-traces/303559/8 "2022-05-25T21:52:01Z")

</div>

Thank you @nchaulet ! I was able to delete the non-existent agent policy with this command. Very helpful. For reference for anyone visiting this thread I had to delete it with a user with the following role:

```auto
POST /_security/role/kibana_removal_danger
{ 
  "indices": [ 
{
  "names": [".kibana*"], 
  "privileges": ["create_doc","create","delete","index","write","all"],
  "allow_restricted_indices": true 
}
] 
}

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 22, 2022, 9:52pm UTC](https://discuss.elastic.co/t/recorded-future-integration-package-setup-stack-traces/303559/9 "2022-06-22T21:52:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
