Managed integrations

[GyciakasGh0st]

We added o365 in managed integrations and no setting for indexes appearing

We synchronized stack we waited for about a week nothing. How we can debug it ?

[cm-ops]

Did you add the integration to a policy in Fleet?

[GyciakasGh0st]

We tried here also

[GyciakasGh0st]

Any ideas ?

[reyesj2]

If you have the configuration in manager -> managed_integrations then please go onto the manager cli and try running each of the following and share any errors they produce

sudo so-elastic-fleet-optional-integrations-load

sudo salt-call state.apply manager.managed_soc_annotations

[GyciakasGh0st]

[reyesj2]

Okay that first command didn't get to fully run due to elasticsearch templates not all being loaded yet.

Try running this

sudo rm -rf /opt/so/conf/elasticsearch/templates/index/*

sudo so-checkin

When you run the so-checkin let me know if you see any red output (that should indicate some kind of configuration failed to run correctly.)

I suspect you have a stale/unused/invalid index template in /opt/so/conf/elasticsearch/templates/index/ and removing them with the first command and allowing them to be regenerated should resolve your issue.

[GyciakasGh0st]

Red text:

---

      ID: so-elasticsearch-templates
Function: cmd.run
    Name: /usr/sbin/so-elasticsearch-templates-load
  Result: False
 Comment: Command "/usr/sbin/so-elasticsearch-templates-load" run
 Started: 04:43:34.455964
Duration: 47137.977 ms
 Changes:   

I Founded some errors in white text
RROR: Could not load template file: so-logs-m365_defender.event-template.json
Exiting.
[ERROR ] retcode: 1
[ERROR ] {'pid': 2607738, 'retcode': 1, 'stdout': 'State file /opt/so/state/estemplates.txt not found. Running so-elasticsearch-templates-load.\nWaitin

[reyesj2]

Do you get any output from the following?

sudo salt-call pillar.get elasticsearch:index_settings

Is m365 a template you were trying to update settings to? If you have custom settings you can try to pull those back and then see if the so-checkin finishes successfully. There could be an issue with the configs you're attempting to use

You can try manually loading that template and see what error it gives for why it can't load the template. Integration could be corrupt or isn't able to update? You can look at the m365 integration through fleet and see if any update is available or if you can 'reinstall' it

sudo so-elasticsearch-query _index_template/so-logs-m365_defender.event -d@/opt/so/conf/elasticsearch/templates/addon-index/so-logs-m365_defender.event-template.json -XPUT

This is the UI where you might reinstall or see if an error presents for the integration

[GyciakasGh0st]

local:
    ----------
    global_overrides:
        ----------
        index_template:
            ----------
            template:
                ----------
                settings:
                    ----------
                    index:
                        ----------
                        number_of_replicas:
                            1
        policy:
            ----------
            phases:
                ----------
                delete:
                    ----------
                    min_age:
                        71d
    so-detection:
        ----------
        index_template:
            ----------
            template:
                ----------
                settings:
                    ----------
                    index:
                        ----------
                        number_of_replicas:
                            1
    so-import:
        ----------
        index_template:
            ----------
            template:
                ----------
                settings:
                    ----------
                    index:
                        ----------
                        final_pipeline:
                            banned-ip-pipeline
    so-logs:
        ----------
        index_template:
            ----------
            template:
                ----------
                settings:
                    ----------
                    index:
                        ----------
                        number_of_replicas:
                            1
    so-logs-detections_x_alerts:
        ----------
        index_template:
            ----------
            template:
                ----------
                settings:
                    ----------
                    index:
                        ----------
                        number_of_replicas:
                            1
    so-logs-elastic_agent_x_filebeat:
        ----------
        index_template:
            ----------
            template:
                ----------
                settings:
                    ----------
                    index:
                        ----------
                        number_of_replicas:
                            1
    so-logs-elastic_agent_x_fleet_server:
        ----------
        index_template:
            ----------
            template:
                ----------
                settings:
                    ----------
                    index:
                        ----------
                        number_of_replicas:
                            1
    so-logs-elastic_agent_x_metricbeat:
        ----------
        index_template:
            ----------
            template:
                ----------
                settings:
                    ----------
                    index:
                        ----------
                        number_of_replicas:
                            1
    so-logs-endpoint_x_diagnostic_x_collection:
        ----------
        index_template:
            ----------
            template:
                ----------
                settings:
                    ----------
                    index:
                        ----------
                        number_of_replicas:
                            1
    so-logs-endpoint_x_events_x_api:
        ----------
        index_template:
            ----------
            composed_of:
                - logs-endpoint.events.api@package
                - logs-endpoint.events.api@custom
                - event-mappings
                - so-fleet_integrations.ip_mappings-1
                - so-fleet_globals-1
                - so-fleet_agent_id_verification-1
            template:
                ----------
                settings:
                    ----------
                    index:
                        ----------
                        number_of_replicas:
                            1
    so-logs-endpoint_x_events_x_file:
        ----------
        index_template:
            ----------
            template:
                ----------
                settings:
                    ----------
                    index:
                        ----------
                        number_of_replicas:
                            1
    so-logs-endpoint_x_events_x_library:
        ----------
        index_template:
            ----------
            template:
                ----------
                settings:
                    ----------
                    index:
                        ----------
                        number_of_replicas:
                            1
    so-logs-endpoint_x_events_x_network:
        ----------
        index_template:
            ----------
            template:
                ----------
                settings:
                    ----------
                    index:
                        ----------
                        number_of_replicas:
                            1
    so-logs-endpoint_x_events_x_process:
        ----------
        index_template:
            ----------
            template:
                ----------
                settings:
                    ----------
                    index:
                        ----------
                        number_of_replicas:
                            1
    so-logs-endpoint_x_events_x_registry:
        ----------
        index_template:
            ----------
            template:
                ----------
                settings:
                    ----------
                    index:
                        ----------
                        number_of_replicas:
                            1
    so-logs-endpoint_x_events_x_security:
        ----------
        index_template:
            ----------
            template:
                ----------
                settings:
                    ----------
                    index:
                        ----------
                        number_of_replicas:
                            1
    so-logs-system_x_application:
        ----------
        index_template:
            ----------
            template:
                ----------
                settings:
                    ----------
                    index:
                        ----------
                        number_of_replicas:
                            1
    so-logs-system_x_auth:
        ----------
        index_template:
            ----------
            template:
                ----------
                settings:
                    ----------
                    index:
                        ----------
                        mapping:
                            ----------
                            total_fields:
                                ----------
                                limit:
                                    5000
                        number_of_replicas:
                            1
    so-logs-system_x_security:
        ----------
        index_template:
            ----------
            composed_of:
                - event-mappings
                - logs-system.security@package
                - logs-system.security@custom
                - so-fleet_integrations.ip_mappings-1
                - so-fleet_globals-1
                - so-fleet_agent_id_verification-1
                - so-system-mappings
            template:
                ----------
                settings:
                    ----------
                    index:
                        ----------
                        number_of_replicas:
                            1
    so-logs-system_x_syslog:
        ----------
        index_template:
            ----------
            template:
                ----------
                settings:
                    ----------
                    index:
                        ----------
                        number_of_replicas:
                            1
    so-logs-system_x_system:
        ----------
        index_template:
            ----------
            template:
                ----------
                settings:
                    ----------
                    index:
                        ----------
                        number_of_replicas:
                            1
    so-logs-windows_x_powershell:
        ----------
        index_template:
            ----------
            template:
                ----------
                settings:
                    ----------
                    index:
                        ----------
                        number_of_replicas:
                            1
    so-logs-windows_x_powershell_operational:
        ----------
        index_template:
            ----------
            template:
                ----------
                settings:
                    ----------
                    index:
                        ----------
                        number_of_replicas:
                            1
    so-metrics-endpoint_x_metadata:
        ----------
        index_template:
            ----------
            template:
                ----------
                settings:
                    ----------
                    index:
                        ----------
                        number_of_replicas:
                            1
    so-metrics-endpoint_x_policy:
        ----------
        index_template:
            ----------
            template:
                ----------
                settings:
                    ----------
                    index:
                        ----------
                        number_of_replicas:
                            1
    so-strelka:
        ----------
        index_template:
            ----------
            template:
                ----------
                settings:
                    ----------
                    index:
                        ----------
                        number_of_replicas:
                            1
    so-suricata:
        ----------
        index_template:
            ----------
            template:
                ----------
                settings:
                    ----------
                    index:
                        ----------
                        number_of_replicas:
                            1
    so-suricata_x_alerts:
        ----------
        index_template:
            ----------
            template:
                ----------
                settings:
                    ----------
                    index:
                        ----------
                        number_of_replicas:
                            1
    so-zeek:
        ----------
        index_template:
            ----------
            template:
                ----------
                settings:
                    ----------
                    index:
                        ----------
                        number_of_shards:
                            1
                            ```

Reinstaled integrtation. Now check in with no errors

Summary for local
--------------
Succeeded: 607 (changed=33)
Failed:      0
--------------
Total states run:     607
Total run time:   639.144 s

But still not apearing any setting for index tempalte such as change repplicas number and etc.

[reyesj2]

Can you run sudo salt-call state.apply manager.managed_soc_annotations does that complete successfully? Have you tried restarting SOC and then checking if the index settings show up? sudo so-restart soc --force

What gets output if you run

 grep 'o365' /opt/so/saltstack/default/salt/elasticsearch/soc_elasticsearch.yaml

[GyciakasGh0st]

We done sudo so-restart soc --force
Summary for local

Succeeded: 71 (changed=4)
Failed: 0

Total states run: 71
Total run time: 14.938 s

And then tried other commands
[bkadmin@manager-soc ~]$ sudo salt-call state.apply manager.managed_soc_annotations
local:
Data failed to compile:

The function "state.highstate" is running as PID 2095367 and was started at 2026, Jun 11 04:24:06.477888 with jid 20260611042406477888

[bkadmin@manager-soc ~]$ grep 'o365' /opt/so/saltstack/default/salt/elasticsearch/soc_elasticsearch.yaml
[bkadmin@manager-soc ~]$

Integration still not apering

[GyciakasGh0st]

Any other options what we could try ?

[reyesj2]

can you try the following

so-yaml.py get /opt/so/saltstack/local/pillar/elasticsearch/soc_elasticsearch.sls elasticsearch.managed_integrations && so-yaml.py remove /opt/so/saltstack/local/pillar/elasticsearch/soc_elasticsearch.sls elasticsearch.managed_integrations

that should say 'Key 'elasticsearch.managed_integrations' not found by so-yaml.py'

ll -l /opt/so/saltstack/local/pillar/manager/


-rw-r-----. 1 socore socore  0 May  8  2025 adv_manager.sls
-rw-r-----. 1 socore socore 53 May  8  2025 soc_manager.sls

these files should be owned by 'socore:socore'

Earlier in the conversation you had issues with loading the default templates, did you mean to add 'replica:1 to almost every index template individually vs adding it to the 'global_overrides'?

What output do you get if you run

sudo so-elasticsearch-templates-load
sudo so-elastic-fleet-optional-integrations-load

and what files do you have listed in

ll /opt/so/state/

[GyciakasGh0st]

after this sudo so-elasticsearch-templates-load o365 appeared . We will try add other integrations.

"Earlier in the conversation you had issues with loading the default templates, did you mean to add 'replica:1 to almost every index template individually vs adding it to the 'global_overrides'?" We redone everything via global overrides

[GyciakasGh0st]

Everyhink is working now. Thank you for your help