diff --git a/raw-migrated-files/docs-content/serverless/agentless-integration-troubleshooting.md b/raw-migrated-files/docs-content/serverless/agentless-integration-troubleshooting.md deleted file mode 100644 index d3db11d4fe..0000000000 --- a/raw-migrated-files/docs-content/serverless/agentless-integration-troubleshooting.md +++ /dev/null @@ -1,52 +0,0 @@ -# Agentless integrations FAQ [agentless-integration-troubleshooting] - -Frequently asked questions and troubleshooting steps for {{elastic-sec}}'s agentless CSPM integration. - - -## When I make a new integration, when will I see the agent appear on the Integration Policies page? [_when_i_make_a_new_integration_when_will_i_see_the_agent_appear_on_the_integration_policies_page] - -After you create a new agentless integration, the new integration policy may show a button that says **Add agent** instead of the associated agent for several minutes during agent enrollment. No action is needed other than refreshing the page once enrollment is complete. - - -## How do I troubleshoot an `Offline` agent? [_how_do_i_troubleshoot_an_offline_agent] - -For agentless integrations to successfully connect to {{elastic-sec}}, the {{fleet}} server host value must be the default. Otherwise, the agent status on the {{fleet}} page will be `Offline`, and logs will include the error `[elastic_agent][error] Cannot checkin in with fleet-server, retrying`. - -To troubleshoot this issue: - -1. Find **{{fleet}}** in the navigation menu or use the [global search field](../../../get-started/the-stack.md#kibana-navigation-search). Go to the **Settings** tab. -2. Under **{{fleet}} server hosts**, click the **Actions** button for the policy named `Default`. This opens the Edit {{fleet}} Server flyout. The policy named `Default` should have the **Make this {{fleet}} server the default one** setting enabled. If not, enable it, then delete your integration and create it again. - -::::{note} -If the **Make this {{fleet}} server the default one** setting was already enabled but problems persist, it’s possible someone changed the default {{fleet}} server’s **URL** value. In this case, contact Elastic Support to find out what the original **URL** value was, update the settings to match this value, then delete your integration and create it again. -:::: - - - -## How do I troubleshoot an `Unhealthy` agent? [_how_do_i_troubleshoot_an_unhealthy_agent] - -On the **{{fleet}}** page, the agent associated with an agentless integration has a name that begins with `agentless`. To troubleshoot an `Unhealthy` agent: - -* Confirm that you entered the correct credentials for the cloud provider you’re monitoring. The following is an example of an error log resulting from using incorrect AWS credentials: - - ``` - [elastic_agent.cloudbeat][error] Failed to update registry: failed to get AWS accounts: operation error Organizations: ListAccounts, get identity: get credentials: failed to refresh cached credentials, operation error STS: AssumeRole, https response error StatusCode: 403, RequestID: XXX, api error AccessDenied: User: XXX is not authorized to perform: sts:AssumeRole on resource:XXX - ``` - - -For instructions on checking {{fleet}} logs, refer to [{{fleet}} troubleshooting](../../../troubleshoot/ingest/fleet/common-problems.md). - - -## How do I delete an agentless integration? [_how_do_i_delete_an_agentless_integration] - -::::{note} -Deleting your integration will remove all associated resources and stop data ingestion. -:::: - - -When you create a new agentless CSPM integration, a new agent policy appears within the **Agent policies** tab on the **{{fleet}}*** page, but you can’t use the ***Delete integration** button on this page. Instead, you must delete the integration from the CSPM Integration’s **Integration policies** tab. - -1. Find **Integrations** in the navigation menu or use the [global search field](../../../get-started/the-stack.md#kibana-navigation-search), then search for and select `CSPM`. -2. Go to the CSPM Integration’s **Integration policies** tab. -3. Find the integration policy for the integration you want to delete. Click **Actions**, then **Delete integration**. -4. Confirm by clicking **Delete integration** again. diff --git a/raw-migrated-files/docs-content/serverless/security-agentless-integrations.md b/raw-migrated-files/docs-content/serverless/security-agentless-integrations.md deleted file mode 100644 index c4d769ad14..0000000000 --- a/raw-migrated-files/docs-content/serverless/security-agentless-integrations.md +++ /dev/null @@ -1,11 +0,0 @@ -# Agentless integrations [security-agentless-integrations] - -[beta] - -Agentless integrations provide a means to ingest data while avoiding the orchestration, management, and maintenance needs associated with standard ingest infrastructure. Using agentless integrations makes manual agent deployment unnecessary, allowing you to focus on your data instead of the agent that collects it. - -We currently support one agentless integration: cloud security posture management (CSPM). Using this integration’s agentless deployment option, you can enable Elastic’s CSPM capabilities just by providing the necessary credentials. Agentless CSPM deployments support AWS, Azure, and GCP accounts. - -To learn more about agentless CSPM deployments, refer to the getting started guides for CSPM on [AWS](../../../solutions/security/cloud/get-started-with-cspm-for-aws.md), [GCP](../../../solutions/security/cloud/get-started-with-cspm-for-gcp.md), or [Azure](../../../solutions/security/cloud/get-started-with-cspm-for-azure.md). - - diff --git a/raw-migrated-files/security-docs/security/agentless-integrations.md b/raw-migrated-files/security-docs/security/agentless-integrations.md deleted file mode 100644 index daa3ebe98b..0000000000 --- a/raw-migrated-files/security-docs/security/agentless-integrations.md +++ /dev/null @@ -1,65 +0,0 @@ -# Agentless integrations [agentless-integrations] - -::::{warning} -This functionality is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features. -:::: - - -Agentless integrations provide a means to ingest data while avoiding the orchestration, management, and maintenance needs associated with standard ingest infrastructure. Using agentless integrations makes manual agent deployment unnecessary, allowing you to focus on your data instead of the agent that collects it. - -We currently support one agentless integration: cloud security posture management (CSPM). Using this integration’s agentless deployment option, you can enable Elastic’s CSPM capabilities just by providing the necessary credentials. Agentless CSPM deployments support AWS, Azure, and GCP accounts. - -To learn more about agentless CSPM deployments, refer to the getting started guides for CSPM on [AWS](../../../solutions/security/cloud/get-started-with-cspm-for-aws.md), [Azure](../../../solutions/security/cloud/get-started-with-cspm-for-azure.md), or [GCP](../../../solutions/security/cloud/get-started-with-cspm-for-gcp.md). - -## Agentless integrations FAQ [agentless-integration-troubleshooting] - -Frequently asked questions and troubleshooting steps for {{elastic-sec}}'s agentless CSPM integration. - - -#### When I make a new integration, when will I see the agent appear on the Integration Policies page? [_when_i_make_a_new_integration_when_will_i_see_the_agent_appear_on_the_integration_policies_page] - -After you create a new agentless integration, the new integration policy may show a button that says **Add agent** instead of the associated agent for several minutes during agent enrollment. No action is needed other than refreshing the page once enrollment is complete. - - -#### How do I troubleshoot an `Offline` agent? [_how_do_i_troubleshoot_an_offline_agent] - -For agentless integrations to successfully connect to {{elastic-sec}}, the {{fleet}} server host value must be the default. Otherwise, the agent status on the {{fleet}} page will be `Offline`, and logs will include the error `[elastic_agent][error] Cannot checkin in with fleet-server, retrying`. - -To troubleshoot this issue: - -1. Find **{{fleet}}** in the navigation menu or use the [global search field](../../../get-started/the-stack.md#kibana-navigation-search). Go to the **Settings** tab. -2. Under **{{fleet}} server hosts**, click the **Actions** button for the policy named `Default`. This opens the Edit {{fleet}} Server flyout. The policy named `Default` should have the **Make this {{fleet}} server the default one** setting enabled. If not, enable it, then delete your integration and create it again. - -::::{note} -If the **Make this {{fleet}} server the default one** setting was already enabled but problems persist, it’s possible someone changed the default {{fleet}} server’s **URL** value. In this case, contact Elastic Support to find out what the original **URL** value was, update the settings to match this value, then delete your integration and create it again. -:::: - - - -#### How do I troubleshoot an `Unhealthy` agent? [_how_do_i_troubleshoot_an_unhealthy_agent] - -On the **{{fleet}}** page, the agent associated with an agentless integration has a name that begins with `agentless`. To troubleshoot an `Unhealthy` agent: - -* Confirm that you entered the correct credentials for the cloud provider you’re monitoring. The following is an example of an error log resulting from using incorrect AWS credentials: - - ``` - [elastic_agent.cloudbeat][error] Failed to update registry: failed to get AWS accounts: operation error Organizations: ListAccounts, get identity: get credentials: failed to refresh cached credentials, operation error STS: AssumeRole, https response error StatusCode: 403, RequestID: XXX, api error AccessDenied: User: XXX is not authorized to perform: sts:AssumeRole on resource:XXX - ``` - - -For instructions on checking {{fleet}} logs, refer to [{{fleet}} troubleshooting](../../../troubleshoot/ingest/fleet/common-problems.md). - - -#### How do I delete an agentless integration? [_how_do_i_delete_an_agentless_integration] - -::::{note} -Deleting your integration will remove all associated resources and stop data ingestion. -:::: - - -When you create a new agentless CSPM integration, a new agent policy appears within the **Agent policies** tab on the **{{fleet}}*** page, but you can’t use the ***Delete integration** button on this page. Instead, you must delete the integration from the CSPM Integration’s **Integration policies** tab. - -1. Find **Integrations** in the navigation menu or use the [global search field](../../../get-started/the-stack.md#kibana-navigation-search), then search for and select `CSPM`. -2. Go to the CSPM Integration’s **Integration policies** tab. -3. Find the integration policy for the integration you want to delete. Click **Actions**, then **Delete integration**. -4. Confirm by clicking **Delete integration** again. diff --git a/raw-migrated-files/toc.yml b/raw-migrated-files/toc.yml index 5f6388b4a7..09a9c42f80 100644 --- a/raw-migrated-files/toc.yml +++ b/raw-migrated-files/toc.yml @@ -254,7 +254,6 @@ toc: children: - file: docs-content/serverless/_cloud_native_vulnerability_management_dashboard.md - file: docs-content/serverless/action-connectors.md - - file: docs-content/serverless/agentless-integration-troubleshooting.md - file: docs-content/serverless/ai-assistant-knowledge-base.md - file: docs-content/serverless/application-and-service-monitoring.md - file: docs-content/serverless/attack-discovery.md @@ -411,7 +410,6 @@ toc: - file: docs-content/serverless/security-advanced-entity-analytics.md - file: docs-content/serverless/security-advanced-settings.md - file: docs-content/serverless/security-agent-tamper-protection.md - - file: docs-content/serverless/security-agentless-integrations.md - file: docs-content/serverless/security-ai-assistant-esql-queries.md - file: docs-content/serverless/security-ai-assistant.md - file: docs-content/serverless/security-ai-for-security.md @@ -812,7 +810,6 @@ toc: - file: security-docs/security/advanced-entity-analytics-overview.md - file: security-docs/security/advanced-settings.md - file: security-docs/security/agent-tamper-protection.md - - file: security-docs/security/agentless-integrations.md - file: security-docs/security/ai-assistant-knowledge-base.md - file: security-docs/security/ai-for-security.md - file: security-docs/security/alert-suppression.md diff --git a/solutions/security/get-started/agentless-integrations.md b/solutions/security/get-started/agentless-integrations.md index 9eb85c8ae7..d807cbc552 100644 --- a/solutions/security/get-started/agentless-integrations.md +++ b/solutions/security/get-started/agentless-integrations.md @@ -4,13 +4,15 @@ mapped_urls: - https://www.elastic.co/guide/en/serverless/current/security-agentless-integrations.html --- -# Agentless integrations +# Agentless integrations [agentless-integrations] -% What needs to be done: Refine +::::{warning} +This functionality is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features. +:::: -% Scope notes: Pull out the Agentless integrations FAQ section into its own troubleshooting topic, and leave the introductory section in its current place -% Use migrated content from existing pages that map to this page: +Agentless integrations provide a means to ingest data while avoiding the orchestration, management, and maintenance needs associated with standard ingest infrastructure. Using agentless integrations makes manual agent deployment unnecessary, allowing you to focus on your data instead of the agent that collects it. -% - [ ] ./raw-migrated-files/security-docs/security/agentless-integrations.md -% - [ ] ./raw-migrated-files/docs-content/serverless/security-agentless-integrations.md \ No newline at end of file +We currently support one agentless integration: cloud security posture management (CSPM). Using this integration’s agentless deployment option, you can enable Elastic’s CSPM capabilities just by providing the necessary credentials. Agentless CSPM deployments support AWS, Azure, and GCP accounts. + +To learn more about agentless CSPM deployments, refer to the getting started guides for CSPM on [AWS](../cloud/get-started-with-cspm-for-aws.md), [Azure](../cloud/get-started-with-cspm-for-azure.md), or [GCP](../cloud/get-started-with-cspm-for-gcp.md) diff --git a/troubleshoot/security/agentless-integrations.md b/troubleshoot/security/agentless-integrations.md index dbd6c18bb6..30d53c9675 100644 --- a/troubleshoot/security/agentless-integrations.md +++ b/troubleshoot/security/agentless-integrations.md @@ -4,13 +4,55 @@ mapped_pages: - https://www.elastic.co/guide/en/serverless/current/agentless-integration-troubleshooting.html --- -# Agentless integrations +# Agentless integrations FAQ [agentless-integration-troubleshooting] -% What needs to be done: Refine +Frequently asked questions and troubleshooting steps for {{elastic-sec}}'s agentless CSPM integration. -% Scope notes: Pull out the Agentless integrations FAQ section into its own troubleshooting topic, and leave the introductory section in its current place -% Use migrated content from existing pages that map to this page: +## When I make a new integration, when will I see the agent appear on the Integration Policies page? [_when_i_make_a_new_integration_when_will_i_see_the_agent_appear_on_the_integration_policies_page] -% - [ ] ./raw-migrated-files/security-docs/security/agentless-integrations.md -% - [ ] ./raw-migrated-files/docs-content/serverless/agentless-integration-troubleshooting.md \ No newline at end of file +After you create a new agentless integration, the new integration policy may show a button that says **Add agent** instead of the associated agent for several minutes during agent enrollment. No action is needed other than refreshing the page once enrollment is complete. + + +## How do I troubleshoot an `Offline` agent? [_how_do_i_troubleshoot_an_offline_agent] + +For agentless integrations to successfully connect to {{elastic-sec}}, the {{fleet}} server host value must be the default. Otherwise, the agent status on the {{fleet}} page will be `Offline`, and logs will include the error `[elastic_agent][error] Cannot checkin in with fleet-server, retrying`. + +To troubleshoot this issue: + +1. Find **{{fleet}}** in the navigation menu or use the [global search field](../../get-started/the-stack.md#kibana-navigation-search). Go to the **Settings** tab. +2. Under **{{fleet}} server hosts**, click the **Actions** button for the policy named `Default`. This opens the Edit {{fleet}} Server flyout. The policy named `Default` should have the **Make this {{fleet}} server the default one** setting enabled. If not, enable it, then delete your integration and create it again. + +::::{note} +If the **Make this {{fleet}} server the default one** setting was already enabled but problems persist, it’s possible someone changed the default {{fleet}} server’s **URL** value. In this case, contact Elastic Support to find out what the original **URL** value was, update the settings to match this value, then delete your integration and create it again. +:::: + + + +## How do I troubleshoot an `Unhealthy` agent? [_how_do_i_troubleshoot_an_unhealthy_agent] + +On the **{{fleet}}** page, the agent associated with an agentless integration has a name that begins with `agentless`. To troubleshoot an `Unhealthy` agent: + +* Confirm that you entered the correct credentials for the cloud provider you’re monitoring. The following is an example of an error log resulting from using incorrect AWS credentials: + + ``` + [elastic_agent.cloudbeat][error] Failed to update registry: failed to get AWS accounts: operation error Organizations: ListAccounts, get identity: get credentials: failed to refresh cached credentials, operation error STS: AssumeRole, https response error StatusCode: 403, RequestID: XXX, api error AccessDenied: User: XXX is not authorized to perform: sts:AssumeRole on resource:XXX + ``` + + +For instructions on checking {{fleet}} logs, refer to [{{fleet}} troubleshooting](../ingest/fleet/common-problems.md). + + +## How do I delete an agentless integration? [_how_do_i_delete_an_agentless_integration] + +::::{note} +Deleting your integration will remove all associated resources and stop data ingestion. +:::: + + +When you create a new agentless CSPM integration, a new agent policy appears within the **Agent policies** tab on the **{{fleet}}** page, but you can’t use the **Delete integration** button on this page. Instead, you must delete the integration from the CSPM Integration’s **Integration policies** tab. + +1. Find **Integrations** in the navigation menu or use the [global search field](../../get-started/the-stack.md#kibana-navigation-search), then search for and select `CSPM`. +2. Go to the CSPM Integration’s **Integration policies** tab. +3. Find the integration policy for the integration you want to delete. Click **Actions**, then **Delete integration**. +4. Confirm by clicking **Delete integration** again.