Question on security onion, elastic permissions

[killmasta93]

Hi
I was wondering if someone could shed some light, Currently installed the elastic agent, with the Elastic defender policy, but when i try to go to the url i keep getting permission denied not sure what else i missed?

https://192.168.7.225/kibana/app/security/administration/endpoints

[cm-ops]

We hide that in the default space, but you might need to configure security privledges, for that Endpoint List. https://www.elastic.co/guide/en/security/current/endpoint-management-req.html

[killmasta93]

@cm-ops thanks for the reply, i was trying to follow this guide https://www.youtube.com/watch?v=KuzYA_0zHkY
which shows the part of the defend,
i was checking the link, but does not let me edit the kibana admin user,
would i need to create another user? and copy the role then add the permissions?
Thank you

[cm-ops]

In the video he is using the Elastic Defend on a standalone Elastic install, not Sercurity Onion. https://docs.securityonion.net/en/2.4/elastic-fleet.html#elastic-defend-endpoints-elastic-defend-integration is in the endpoints-initial policy and you will see logs in Security Onion which you can use to build detections on.

[killmasta93]

thanks for clearing that up for me