Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Changes to Ingest settings (ex ES URL) do not propagate down to running Agents with Elastic Endpoint Security running #76136

Closed
kevinlog opened this issue Aug 27, 2020 · 6 comments
Assignees
Labels
Team:Defend Workflows “EDR Workflows” sub-team of Security Solution Team:Fleet Team label for Observability Data Collection Fleet team

Comments

@kevinlog
Copy link
Contributor

kevinlog commented Aug 27, 2020

Kibana version:
7.9

Elasticsearch version:
7.9

Server OS version:
N/A, not relevant

Browser version:
Chrome

Browser OS version:
Mac

Original install method (e.g. download page, yum, from source, etc.):
N/A, not relevant - could be cloud, source, etc

Describe the bug:
This is a workflow "bug" that makes things confusing for users.

When users first deploy Agent/Endpoints, they may not update the "Ingest > Settings" to contain the correct Kibana and ES URLs so that the subprocesses, such as the Endpoint, can stream data to the correct place. In the case of Endpoint, it requires that that user manually saves the Endpoint Integration on any Agent config where they want to update the settings to running Agent/Endpoints.

Steps to reproduce:

  1. Add Endpoint Security Integration to Agent configuration
  2. Add Agent with the Agent configuration containing Endpoint Security
  3. Wait for the Agent to come online and see Endpoint running
  4. In Ingest Manager, open "Ingest > Settings" and make a change to the ES URL and Save
  5. On the Host running the Agent/Endpoint, open elastic-endpoint.yaml and see that the new ES URL is not updated (bug)

Workaround:
6. In Ingest Manager, click on the Agent config, click "Edit integration" in the table to Endpoint Integration. Save on this screen without making changes to trigger an update of the Agent config that will be sent down to Endpoint.
7. See that the updated URLs make it the elastic-endpoint.yaml

Expected behavior:
Making changes to the "Ingest > Settings" shouldn't require a manual save of the Endpoint Integration to propagate as this is confusing to the user.

Screenshots (if relevant):
Settings in Ingest:
image

Save changes to URLs:
image

After changes to URLs come to Config details, click "Edit Integration":
image

Save Integration:
image

Errors in browser console (if relevant):

Provide logs and/or server output (if relevant):

Any additional context:

@kevinlog kevinlog added the Team:Fleet Team label for Observability Data Collection Fleet team label Aug 27, 2020
@elasticmachine
Copy link
Contributor

Pinging @elastic/ingest-management (Team:Ingest Management)

@elasticmachine
Copy link
Contributor

Pinging @elastic/endpoint-management (Team:Endpoint Management)

@kevinlog kevinlog changed the title Changes to Ingest settings (ex ES URL) do not propagate down running Agents with Elastic Endpoint Security running Changes to Ingest settings (ex ES URL) do not propagate down to running Agents with Elastic Endpoint Security running Aug 27, 2020
@ph
Copy link
Contributor

ph commented Aug 27, 2020

@neptunian Can you take a look, since you are adding a feature on that page? Please lets make sure we can backport it to 7.9.x.

@neptunian
Copy link
Contributor

This is a known issue and is solved with #75712, but tagged for 7.10. However saving that flyout makes 2 API requests, one to save settings which includes the Kibana urls and one to save output. We'd need to add that saving the output also triggers a change to the agent configuration. I think it would also make sense for it to go in 7.10, unless we want them both to be in 7.9.x

@ph
Copy link
Contributor

ph commented Oct 19, 2020

7.10 is fine, @neptunian or @nchaulet do both behavior are fixed?

@nchaulet
Copy link
Member

Yes both are fixed in 7.10

@MindyRS MindyRS added Team:Defend Workflows “EDR Workflows” sub-team of Security Solution and removed Team:Endpoint Management labels Oct 29, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Team:Defend Workflows “EDR Workflows” sub-team of Security Solution Team:Fleet Team label for Observability Data Collection Fleet team
Projects
None yet
Development

No branches or pull requests

6 participants