Changing the order of Fleet Server used by Elastic Agents during enrollment

[DoughnutPeach]

Version

2.4.50

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

cloud

Hardware Specs

Exceeds minimum requirements

CPU

32

RAM

16

Storage for /

500GB

Storage for /nsm

1TB

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Ask

I want to be able to specify which Fleet Server gets prioritized when enrolling my Elastic Agents.

e.g. For our use-case, we want the Elastic Agents to prioritize sending logs to SO Fleet Server > SO Master Server.

I understand that the priority is based on the list of Fleet server hosts found in the Elastic Fleet - Settings page. Particularly, the of the list matters - Elastic Agent will enroll onto the first contactable Fleet server seen in this list, and prioritize forwarding logs to that server.

From the doc, it mentions that these settings are managed by Security Onion here (https://docs.securityonion.net/en/2.4/elastic-fleet.html#settings).

Question

Where can I change the configuration for Security Onion?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[8inaryMata1eao]

[defensivedepth]

@8inaryMata1eao Please start a new Discussion, your question is different than what is posted here.

[defensivedepth]

@DoughnutPeach I've updated the docs to cover what you are looking for: https://docs.securityonion.net/en/2.4/elastic-fleet.html#settings

[DoughnutPeach]

@defensivedepth Thanks for updating the docs!

Quick follow-up question - I do not require different Outputs per Agent Policy. Currently, my primary Fleet Server is defaulted to my SO Master Node. I would like to change this (for all Agents and Agent Policy) to my SO Fleet Server instead.

It seems that this should be configurable (without an Elastic License) through the Fleet Settings in Kibana.

I have tried editing this, but it always reverts to defaulting to SO Master as primary.

Is this managed by Salt somewhere? Can I edit this?

[defensivedepth]

Yes, this auto-configuration can be disabled under SOC --> Configuration. Enable "Advanced Settings" and search for enable_auto_configuration. Be aware that if you add another Fleet server or change hostnames, etc, these settings will not be automatically updated.

Also, I am not exactly sure if changing the order will do what you are wanting. What specifically are you thinking it will accomplish? These are contacted in round-robin failover order.