Hello, We use the SentinelOne integration through fleet in our Elastic Cloud environment. Events are being received and processed. The issue is we get "_geoip_database_unavailable_GeoLite2-City.mmdb" errors on all agent logs. We use the build-in ingest pipelines, not modifications have been made…

Perhaps try this... Disable and reenable the geoip databases [image] _geoip_database_unavailable_GeoLite2-ASN.mmdb Beats Sorry but that is not the correct part of the logs... there are many many logs perhaps take the file grep -i geo my-application.log and show those r…

Discuss the Elastic Stack

SentinelOne integration GeoIP database error

Elastic Security SIEM

stephenb (Stephen Brown) May 13, 2023, 2:10pm 2

Perhaps try this...

Disable and reenable the geoip databases

Also, is that the complete error?

Where are you seeing that?

1 Like

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.