Elastic-Agent not showing data.

[rigbyst]

Version

2.4.30

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

8

RAM

64GB

Storage for /

293GB

Storage for /nsm

1.8TB

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I just got back from the Analyst and Threat Hunters course in Texas. Highly Recommend!
I have setup a SO Manager for a distributed environment. I have not setup a Forward node yet. Waiting for access.
I have installed elastic agent with Sysmon on an endpoint and it has successfully connected to the Manager and is "HEALTHY"
I have configured the firewall to allow access from this endpoint. Tcpdump shows data getting to the SO Manager (I realize this does not mean that the data is being ingested.) I have verified that the firewall rules and the source IP match.
There does not seem to be any errors, however none of the elastic agent or sysmon events show up in any of the datasets or indexes. There are plenty of events being sent ( I can see them in the event manager on the windows endpoint.)

I have searched through the other posts about Elastic Agents data not showing but could not find anything that points me in the right direction.

I appreciate any help others could offer
Thank You!

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[rigbyst]

Going to add a Search Node to see if that is the issue.

[reyesj2]

If you installed a manager (not Manager Search) there is no where for the endpoints data to be stored.

[rigbyst]

Yes that is the problem. Thank you for your reply...