elastic agents installation, upgrades and management

[udi-mosh]

Version

2.4.60

Installation Method

Security Onion ISO image

Description

installation

Installation Type

Distributed

Location

airgap

Hardware Specs

Meets minimum requirements

CPU

24

RAM

128

Storage for /

500GB

Storage for /nsm

6TB

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hi,
i want to implement elastic agents and i have some questions:

1. why should i install the pre configured agents ?
2. can i install agents downloaded from elastic ? if so, can i use the latest version ?
3. if i install the downloaded agents, will they be updateable when updating SO includes agent updates ?
   Tnx

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[reyesj2]

You could the elastic agent from Elastic and do the manual configuration including setting up the certs for communication with your Security Onion grid, but you can just use the preconfigured agent and avoid that. I believe the elastic agent version you use is tied to the Elastic version. Security Onion is on 8.10.4

When using fleet managed elastic agents they will get updates from fleet.

[udi-mosh]

@reyesj2 thank you,
the only problem i have with builtin agents from so is that those agents go straight to "initial policy" instead of the policy i configure it to go when i use the correct token when installing. i have read that this is expected and this behavior breaks the automation of the policy assignment and hope SO will change that

[reyesj2]

You can bulk assign agents to a new policy once they have joined fleet. So you could have your 100 agents join and go into the 'endpoints initial' policy and then quickly change them all at once to 'custom' policy without having to touch the endpoints anymore

[udi-mosh]

@reyesj2 thank you.
i am aware to that ability but i am looking for automation. one of the great things i love in SO is the automation in the day to day IT tasks and especially in air-gapped installations. upgrade cycle is so easy, just copy iso and run 1 command. this is what i want when i come to deploy and manage agents. msi installations will be much appreciated too.

[reyesj2]

Go to elastic fleet -> Click on 'Add Agent'
From there select what policy you want the agent to be automatically enrolled into

Scroll down and look at the provided command. One argument is "--enrollment-token=" Copy that token

When you run your so-elastic-agent installer run it with the added argument -token

.\so-elastic-agent_windows_amd64.exe -token <copied token for your custom policy>

It will automatically enroll into the provided policy

[udi-mosh]

@reyesj2 thank you.