Security overview doesn't show any data

Elastic Security
1

Hi,
I've installed the new version 7.9.
I've 4 hosts (Linux/Windows) online in my Fleet tab under Ingest Manager (I've installed elastic agent correctly on them) with some active integrations (Elastic Endpoint Security is one of them, and I can see data in .ds-* indices) and one host with auditbeat ingesting data correctly in the auditbeat-7.9.0-... index, but when I open the Security overview I can´t see anything but the original message 'Welcome to Elastic Security. Let’s get you started....' like no security indices are present in my cluster. The same happens in the rest of the tabs (detections, hosts, network) and the Administration tab shows the original message 'Next step: Enroll an Agent with Elastic Endpoint Security' like no agents are enrolled.

Any help on why the Security overview is not showing my data hosts?

Thanks in advance,
Regards

2

Hi @s_elk,

Could you go to Stack Management -> Advanced Settings (under Kibana section) -> Security Solution and check your Elasticsearch indices ? The defaults are apm-*-transaction*, auditbeat-*, endgame-*, filebeat-*, logs-*, packetbeat-*, winlogbeat-*.

Best,
Christos

3

Thanks Christos for your answer.

Yes, I forgot to say that I've kept the defaults (so the auditbeat-* is there) and added ', *elastic.agent*' to test...

Regards

4

Reinstalled and solved...

Thanks

5

That's great news! Wonder why to be honest :slightly_smiling_face:

6

What was the problem ?
I'm in the same situation on 7.9.1 : 1 agent is enrolled , online and shipping data using a conf with 4 integrations as agent acivity log reports.
But still cant see any new index named as per the security section of kibana adv settings..
Also, i got looped in security > administration : kibana keeps to ask to enroll an agent onto the integration, but one is already enrolled and runnig with same signature..
Any idea why no index were written ?
tnx