« Agentless integrations Configure endpoint protection with Elastic Defend »
Elastic Docs ›Serverless ›Elastic Security Serverless ›Ingest data to Elastic Security ›Agentless integrations

Agentless integrations FAQ

edit

Agentless integrations FAQ

edit

Frequently asked questions and troubleshooting steps for Elastic Security’s agentless CSPM integration.

When I make a new integration, when will I see the agent appear on the Integration Policies page?
edit

After you create a new agentless integration, the new integration policy may show a button that says Add agent instead of the associated agent for several minutes during agent enrollment. No action is needed other than refreshing the page once enrollment is complete.

How do I troubleshoot an Offline agent?
edit

For agentless integrations to successfully connect to Elastic Security, the Fleet server host value must be the default. Otherwise, the agent status on the Fleet page will be Offline, and logs will include the error [elastic_agent][error] Cannot checkin in with fleet-server, retrying.

To troubleshoot this issue:

  1. Find Fleet in the navigation menu or use the global search field. Go to the Settings tab.
  2. Under Fleet server hosts, click the Actions button for the policy named Default. This opens the Edit Fleet Server flyout. The policy named Default should have the Make this Fleet server the default one setting enabled. If not, enable it, then delete your integration and create it again.

If the Make this Fleet server the default one setting was already enabled but problems persist, it’s possible someone changed the default Fleet server’s URL value. In this case, contact Elastic Support to find out what the original URL value was, update the settings to match this value, then delete your integration and create it again.

How do I troubleshoot an Unhealthy agent?
edit

On the Fleet page, the agent associated with an agentless integration has a name that begins with agentless. To troubleshoot an Unhealthy agent:

  • Confirm that you entered the correct credentials for the cloud provider you’re monitoring. The following is an example of an error log resulting from using incorrect AWS credentials:

    [elastic_agent.cloudbeat][error] Failed to update registry: failed to get AWS accounts: operation error Organizations: ListAccounts, get identity: get credentials: failed to refresh cached credentials, operation error STS: AssumeRole, https response error StatusCode: 403, RequestID: XXX, api error AccessDenied: User: XXX is not authorized to perform: sts:AssumeRole on resource:XXX

For instructions on checking {Fleet} logs, refer to Fleet troubleshooting.

How do I delete an agentless integration?
edit

Deleting your integration will remove all associated resources and stop data ingestion.

When you create a new agentless CSPM integration, a new agent policy appears within the Agent policies tab on the Fleet page, but you can’t use the Delete integration button on this page. Instead, you must delete the integration from the CSPM Integration’s Integration policies tab.

  1. Find Integrations in the navigation menu or use the global search field, then search for and select CSPM.
  2. Go to the CSPM Integration’s Integration policies tab.
  3. Find the integration policy for the integration you want to delete. Click Actions, then Delete integration.
  4. Confirm by clicking Delete integration again.
« Agentless integrations Configure endpoint protection with Elastic Defend »