create agentless troubleshooting steps

Author: benironside

docs/getting-started/agentless-troubleshooting.asciidoc

@@ -0,0 +1,42 @@
+[[agentless-integration-troubleshooting]]
+= Agentless integrations FAQ
+
+Frequently asked questions and troubleshooting steps for {elastic-sec}'s agentless CSPM integration.
+
+*When I make a new integration, how long until the agent appears on the agent policies page?*
+
+After you create a new agentless integration, the new integration policy may show a button that says **Add agent** instead of the associated agent for several minutes during agent enrollment. No action is needed other than refreshing the page once enrollment is complete.
+
+*How do I troubleshoot an "Offline" agent?*
+
+For agentless integrations to successfully connect to {elastic-sec}, your Fleet server host value must be the default. Otherwise, the agent status that appears on the Fleet page will be `Offline`, and logs will include the following error `[elastic_agent][error] Cannot checkin in with fleet-server, retrying`. 
+
+To troubleshoot this issue:
+
+. Find **Fleet** in the navigation menu or use the {kibana-ref}/introduction.html#kibana-navigation-search[global search field]. Go to the **Settings** tab.
+. Under **Fleet server hosts**, click the **Actions** button for the policy named `Default`. This opens the **Edit Fleet Server** flyout. The policy named `Default` should have the **Make this Fleet server the default one** setting enabled. If not, enable it, then delete your integration and create it again.
+. If the **Make this Fleet server the default one** setting was already enabled, it's possible someone changed the **URL** value for your default fleet server. In this case, contact Elastic support to find out what the original **URL** value was, update the settings to match this value, then delete your integration and create it again.
+
+*How do I troubleshoot an "Unhealthy" agent?*
+
+On the **Fleet** page, the agent associated with an agentless integration will have a name that begins with `agentless`. To troubleshoot an unhealthy agent:
+
+. Confirm that you entered the correct credentials for the cloud provider you're monitoring. The following is an example of an error log resulting from using incorrect AWS credentials:
++ 
+```
+[elastic_agent.cloudbeat][error] Failed to update registry: failed to get AWS accounts: operation error Organizations: ListAccounts, get identity: get credentials: failed to refresh cached credentials, operation error STS: AssumeRole, https response error StatusCode: 403, RequestID: XXX, api error AccessDenied: User: XXX is not authorized to perform: sts:AssumeRole on resource:XXX
+```
++
+. For information about collecting logs, refer to {fleet-guide}/fleet-troubleshooting.html[Fleet troubleshooting]. 
+
+*How do I delete an agentless integration?*
+
+NOTE: Deleting your integration will remove all associated resources and stop data ingestion.
+
+When you create a new agentless CSPM integration, a new agent policy appears on the **Agent policies** tab of the **Fleet** page, but you can't use the **Delete integration** button on this page. Instead, delete the integration from the CSPM Integration policies page. 
+
+. Find **Integrations** in the navigation menu or use the {kibana-ref}/introduction.html#kibana-navigation-search[global search field], then search for and select `CSPM`.
+. On the CSPM integration page, go to the **Integration policies** tab.
+. Find the integration policy for the integration you want to delete. Click **Actions** then **Delete integration**.
+. Confirm by clicking **Delete integration** again.
+

docs/getting-started/index.asciidoc

@@ -18,6 +18,7 @@ include::ingest-data.asciidoc[leveloffset=+1]
 include::threat-intel-integrations.asciidoc[leveloffset=+2]
 include::automatic-import.asciidoc[leveloffset=+2]
 include::agentless-integrations.asciidoc[leveloffset=+2]
+include::agentless-troubleshooting.asciidoc[leveloffset=+3]
 
 include::security-spaces.asciidoc[leveloffset=+1]