Changes to Ingest settings (ex ES URL) do not propagate down to running Agents with Elastic Endpoint Security running #76136
Labels
Team:Defend Workflows
“EDR Workflows” sub-team of Security Solution
Team:Fleet
Team label for Observability Data Collection Fleet team
Kibana version:
7.9
Elasticsearch version:
7.9
Server OS version:
N/A, not relevant
Browser version:
Chrome
Browser OS version:
Mac
Original install method (e.g. download page, yum, from source, etc.):
N/A, not relevant - could be cloud, source, etc
Describe the bug:
This is a workflow "bug" that makes things confusing for users.
When users first deploy Agent/Endpoints, they may not update the "Ingest > Settings" to contain the correct Kibana and ES URLs so that the subprocesses, such as the Endpoint, can stream data to the correct place. In the case of Endpoint, it requires that that user manually saves the Endpoint Integration on any Agent config where they want to update the settings to running Agent/Endpoints.
Steps to reproduce:
elastic-endpoint.yaml
and see that the new ES URL is not updated (bug)Workaround:
6. In Ingest Manager, click on the Agent config, click "Edit integration" in the table to Endpoint Integration. Save on this screen without making changes to trigger an update of the Agent config that will be sent down to Endpoint.
7. See that the updated URLs make it the
elastic-endpoint.yaml
Expected behavior:
Making changes to the "Ingest > Settings" shouldn't require a manual save of the Endpoint Integration to propagate as this is confusing to the user.
Screenshots (if relevant):
Settings in Ingest:
Save changes to URLs:
After changes to URLs come to Config details, click "Edit Integration":
Save Integration:
Errors in browser console (if relevant):
Provide logs and/or server output (if relevant):
Any additional context:
The text was updated successfully, but these errors were encountered: