Deploying agents on an endpoint

[ranimhassine]

Version

2.4.70

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

4 for security onion

RAM

16

Storage for /

250G

Storage for /nsm

152

Network Traffic Collection

span port

Network Traffic Speeds

more than 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I am trying to deploy elastic agents on a ubuntu-server endpoint
i followed the tutorials and the guidelines in the provided documentation to start the elasticsearch or create an agent or a fleet server...
yet it doesn't seem to work
it always throws the same error of file ELASTIC_SEARCH HOST not found even tho i downloaded it

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

Just to be clear, you followed this https://docs.securityonion.net/en/2.4/elastic-agent.html#deployment? Did you also add the host to the firewall in SOC? Administration –> Configuration –> firewall –> hostgroups -> elastic_agent_endpoint

[ranimhassine]

yes all that is done
actually i managed to deploy the agent and i added a rule for ICMP packet yet when i ping on the host ,i can see a large number of logs in kibana yet i am unable to know their nature , it is like they r unnamed .Moreover when i download the agent diagnostic from the fleet or the logs i find are those related to the installation

[ranimhassine]

hello ever since the 2.4.8 has been released ; is it possible to upgrade from 2.4.7 using soup?

[ranimhassine]

[cm-ops]

Yes you can upgrade to 2.4.80 with soup. What is that screen shot?

[ranimhassine]

all the services stopped working when i updated the 2.4.7 using soup
also i have been trying to flash the 2.4.8 in a USB yet it is not bootble

[dougburks]

also i have been trying to flash the 2.4.8 in a USB yet it is not bootble

First, make sure that you verify the ISO image as shown at https://securityonion.com/download.

Next, make sure that you are using Balena Etcher as recommended at https://docs.securityonion.net/en/2.4/download.html.

If you have further questions relating to updating or creating a bootable USB, please start a new discussion since that's not necessarily related to the subject of this discussion which is Deploying agents on an endpoint.