« Automatic import Spaces and Elastic Security »
Elastic Docs ›Elastic Security Solution [8.17] ›Get started with Elastic Security ›Ingest data to Elastic Security

Agentless integrations

edit

Agentless integrations

edit

This functionality is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features.

Agentless integrations provide a means to ingest data while avoiding the orchestration, management, and maintenance needs associated with standard ingest infrastructure. Using agentless integrations makes manual agent deployment unnecessary, allowing you to focus on your data instead of the agent that collects it.

We currently support one agentless integration: cloud security posture management (CSPM). Using this integration’s agentless deployment option, you can enable Elastic’s CSPM capabilities just by providing the necessary credentials. Agentless CSPM deployments support AWS, Azure, and GCP accounts.

To learn more about agentless CSPM deployments, refer to the getting started guides for CSPM on AWS, Azure, or GCP.

Agentless integrations FAQ

edit

Frequently asked questions and troubleshooting steps for Elastic Security’s agentless CSPM integration.

When I make a new integration, when will I see the agent appear on the Integration Policies page?
edit

After you create a new agentless integration, the new integration policy may show a button that says Add agent instead of the associated agent for several minutes during agent enrollment. No action is needed other than refreshing the page once enrollment is complete.

How do I troubleshoot an Offline agent?
edit

For agentless integrations to successfully connect to Elastic Security, the Fleet server host value must be the default. Otherwise, the agent status on the Fleet page will be Offline, and logs will include the error [elastic_agent][error] Cannot checkin in with fleet-server, retrying.

To troubleshoot this issue:

  1. Find Fleet in the navigation menu or use the global search field. Go to the Settings tab.
  2. Under Fleet server hosts, click the Actions button for the policy named Default. This opens the Edit Fleet Server flyout. The policy named Default should have the Make this Fleet server the default one setting enabled. If not, enable it, then delete your integration and create it again.

If the Make this Fleet server the default one setting was already enabled but problems persist, it’s possible someone changed the default Fleet server’s URL value. In this case, contact Elastic Support to find out what the original URL value was, update the settings to match this value, then delete your integration and create it again.

How do I troubleshoot an Unhealthy agent?
edit

On the Fleet page, the agent associated with an agentless integration has a name that begins with agentless. To troubleshoot an Unhealthy agent:

  • Confirm that you entered the correct credentials for the cloud provider you’re monitoring. The following is an example of an error log resulting from using incorrect AWS credentials:

    [elastic_agent.cloudbeat][error] Failed to update registry: failed to get AWS accounts: operation error Organizations: ListAccounts, get identity: get credentials: failed to refresh cached credentials, operation error STS: AssumeRole, https response error StatusCode: 403, RequestID: XXX, api error AccessDenied: User: XXX is not authorized to perform: sts:AssumeRole on resource:XXX

For instructions on checking {Fleet} logs, refer to Fleet troubleshooting.

How do I delete an agentless integration?
edit

Deleting your integration will remove all associated resources and stop data ingestion.

When you create a new agentless CSPM integration, a new agent policy appears within the Agent policies tab on the Fleet page, but you can’t use the Delete integration button on this page. Instead, you must delete the integration from the CSPM Integration’s Integration policies tab.

  1. Find Integrations in the navigation menu or use the global search field, then search for and select CSPM.
  2. Go to the CSPM Integration’s Integration policies tab.
  3. Find the integration policy for the integration you want to delete. Click Actions, then Delete integration.
  4. Confirm by clicking Delete integration again.
« Automatic import Spaces and Elastic Security »