Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 11 additions & 3 deletions solutions/security/cloud/get-started-with-cspm-for-gcp.md
Original file line number Diff line number Diff line change
Expand Up @@ -35,9 +35,9 @@ You can set up CSPM for GCP either by enrolling a single project, or by enrollin
1. Find **Integrations** in the navigation menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md).
2. Search for `CSPM`, then click on the result.
3. Click **Add Cloud Security Posture Management (CSPM)**.
4. Select **GCP**, then either **GCP Organization** to onboard your whole organization, or **Single Account** to onboard an individual account.
4. Select **GCP**, then either **GCP Organization** to onboard your whole organization, or **Single Project** to onboard an individual account.
5. Give your integration a name that matches the purpose or team of the GCP subscription/organization you want to monitor, for example, `dev-gcp-account`.
6. Click **Advanced options**, then select **Agentless (BETA)**.
6. Under **Deployment Options**, select **Agentless**.
7. Next, you’ll need to authenticate to GCP. Expand the **Steps to Generate GCP Account Credentials** section, then follow the instructions that appear to automatically create the necessary credentials using Google Cloud Shell.
8. Once you’ve provided the necessary credentials, click **Save and continue** to finish deployment. Your data should start to appear within a few minutes.

Expand All @@ -53,7 +53,7 @@ Agentless deployment does not work if you are using [Traffic filtering](/deploy-
1. Find **Integrations** in the navigation menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md).
2. Search for `CSPM`, then click on the result.
3. Click **Add Cloud Security Posture Management (CSPM)**.
4. Under **Configure integration**, select **GCP**, then either **GCP Organization** (recommended) or **Single Account**.
4. Under **Configure integration**, select **GCP**, then either **GCP Organization** (recommended) or **Single Project**.
5. Give your integration a name that matches the purpose or team of the GCP account you want to monitor, for example, `dev-gcp-project`.


Expand Down Expand Up @@ -124,6 +124,10 @@ gcloud organizations add-iam-policy-binding <ORG_ID> \
--role=roles/browser
```

::::{important}
If running this command results in a warning related to conditions, try running it again with `--condition=None`.
::::

::::{note}
The `Cloud Asset Viewer` role grants read access to cloud asset metadata. The `Browser` role grants read access to the project hierarchy.
::::
Expand Down Expand Up @@ -177,6 +181,10 @@ gcloud projects add-iam-policy-binding <PROJECT_ID> \
--role=roles/browser
```

::::{important}
If running this command results in a warning related to conditions, try running it again with `--condition=None`.
::::

::::{note}
The `Cloud Asset Viewer` role grants read access to cloud asset metadata. The `Browser` role grants read access to the project hierarchy.
::::
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ For agentless integrations to successfully connect to {{elastic-sec}}, the {{fle

To troubleshoot this issue:

1. Find **{{fleet}}** in the navigation menu or use the [global search field](../../explore-analyze/find-and-organize/find-apps-and-objects.md). Go to the **Settings** tab.
1. Find **{{fleet}}** in the navigation menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). Go to the **Settings** tab.
2. Under **{{fleet}} server hosts**, click the **Actions** button for the policy named `Default`. This opens the Edit {{fleet}} Server flyout. The policy named `Default` should have the **Make this {{fleet}} server the default one** setting enabled. If not, enable it, then delete your integration and create it again.

::::{note}
Expand All @@ -44,7 +44,7 @@ On the **{{fleet}}** page, the agent associated with an agentless integration ha
```


For instructions on checking {{fleet}} logs, refer to [{{fleet}} troubleshooting](../ingest/fleet/common-problems.md).
For instructions on checking {{fleet}} logs, refer to [{{fleet}} troubleshooting](/troubleshoot/ingest/fleet/common-problems.md).


## How do I delete an agentless integration? [_how_do_i_delete_an_agentless_integration]
Expand All @@ -56,7 +56,7 @@ Deleting your integration will remove all associated resources and stop data ing

When you create a new agentless CSPM integration, a new agent policy appears within the **Agent policies** tab on the **{{fleet}}** page, but you can’t use the **Delete integration** button on this page. Instead, you must delete the integration from the CSPM Integration’s **Integration policies** tab.

1. Find **Integrations** in the navigation menu or use the [global search field](../../explore-analyze/find-and-organize/find-apps-and-objects.md), then search for and select `CSPM`.
1. Find **Integrations** in the navigation menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md), then search for and select `CSPM`.
2. Go to the CSPM Integration’s **Integration policies** tab.
3. Find the integration policy for the integration you want to delete. Click **Actions**, then **Delete integration**.
4. Confirm by clicking **Delete integration** again.
10 changes: 4 additions & 6 deletions solutions/security/get-started/agentless-integrations.md
Original file line number Diff line number Diff line change
Expand Up @@ -12,13 +12,13 @@ applies_to:

Agentless integrations provide a means to ingest data while avoiding the orchestration, management, and maintenance needs associated with standard ingest infrastructure. Using agentless integrations makes manual agent deployment unnecessary, allowing you to focus on your data instead of the agent that collects it.

We support the following agentless integrations:
::::{important}
There are currently no additional costs associated with deploying agentless integrations.
::::

## Generally available (GA) agentless integrations

::::{note}
For a single {{serverless-full}} project, a maxium of 30 agentless deployments are supported.
::::
We fully support the following agentless integrations:

Cloud security posture management (CSPM). Using this integration’s agentless deployment option, you can enable Elastic’s CSPM capabilities just by providing the necessary credentials. Agentless CSPM deployments support AWS, Azure, and GCP accounts.

Expand All @@ -28,8 +28,6 @@ To learn more about agentless CSPM deployments, refer to the getting started gui

::::{warning}
Agentless deployment for the following integrations is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features.

While agentless deployment for these integrations is in beta, for a single {{serverless-full}} project a maxium of five agentless deployments are currently supported.
::::

1. AbuseCH
Expand Down
1 change: 1 addition & 0 deletions solutions/toc.yml
Original file line number Diff line number Diff line change
Expand Up @@ -467,6 +467,7 @@ toc:
- file: security/get-started/automatic-migration.md
- file: security/get-started/automatic-import.md
- file: security/get-started/agentless-integrations.md
- file: security/get-started/agentless-integrations-faq.md
- file: security/get-started/spaces-elastic-security.md
- file: security/get-started/data-views-elastic-security.md
- file: security/get-started/create-runtime-fields-in-elastic-security.md
Expand Down
1 change: 0 additions & 1 deletion troubleshoot/security.md
Original file line number Diff line number Diff line change
Expand Up @@ -16,4 +16,3 @@ This section covers common {{elastic-sec}} related issues and how to resolve the
* [Troubleshoot detection rules](security/detection-rules.md)
* [Troubleshoot {{elastic-defend}}](security/elastic-defend.md)
* [Troubleshoot indicators of compromise](security/indicators-of-compromise.md)
* [Agentless integrations FAQ](security/agentless-integrations.md)
1 change: 0 additions & 1 deletion troubleshoot/toc.yml
Original file line number Diff line number Diff line change
Expand Up @@ -137,7 +137,6 @@ toc:
- file: security/detection-rules.md
- file: security/elastic-defend.md
- file: security/indicators-of-compromise.md
- file: security/agentless-integrations.md
- file: ingest.md
children:
# - file: ingest/enterprise-search/crawls.md
Expand Down
Loading