Skip to content

Commit b73ebb0

Browse files
natasha-moore-elasticmergify[bot]
natasha-moore-elastic
authored and
mergify[bot]
committed
Fixes link ref on Install Elastic Defend page (#6164)
(cherry picked from commit a6c3736) # Conflicts: # docs/serverless/edr-install-config/install-elastic-defend.asciidoc
1 parent 16d772c commit b73ebb0

File tree

2 files changed

+118
-1
lines changed

2 files changed

+118
-1
lines changed

‎docs/getting-started/install-endpoint.asciidoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ Like other Elastic integrations, {elastic-defend} is integrated into the {agent}
2020
[[security-before-you-begin]]
2121
== Before you begin
2222

23-
If you're using macOS, some versions may require you to grant Full Disk Access to different kernels, system extensions, or files. Refer to <<elastic-endpoint-deploy-reqs, requirements for {elastic-endpoint}>> for more information.
23+
If you're using macOS, some versions may require you to grant Full Disk Access to different kernels, system extensions, or files. Refer to <<elastic-endpoint-deploy-reqs>> for more information.
2424

2525
NOTE: {elastic-defend} does not support deployment within an {agent} DaemonSet in Kubernetes.
2626

‎docs/serverless/edr-install-config/install-elastic-defend.asciidoc‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
[[security-install-edr]]
2+
= Install the {elastic-defend} integration
3+
4+
// :description: Start protecting your endpoints with {elastic-defend}.
5+
// :keywords: serverless, security, how-to
6+
7+
++++
8+
<titleabbrev>Install Elastic Defend</titleabbrev>
9+
++++
10+
11+
12+
Like other Elastic integrations, {elastic-defend} is integrated into the {agent} using {fleet-guide}/fleet-overview.html[{fleet}]. Upon configuration, the integration allows the {agent} to monitor events on your host and send data to the {security-app}.
13+
14+
.Requirements
15+
[NOTE]
16+
====
17+
* {fleet} is required for {elastic-defend}.
18+
* To configure the {elastic-defend} integration on the {agent}, you must have permission to use {fleet}.
19+
* You must have the appropriate user role to configure an integration policy and access the **Endpoints** page.
20+
21+
// Placeholder statement until we know which specific roles are required. Classic statement below for reference.
22+
23+
// * You must have the **{elastic-defend} Policy Management: All** <DocLink slug="/serverless/security/endpoint-management-req">privilege</DocLink> to configure an integration policy, and the **Endpoint List** <DocLink slug="/serverless/security/endpoint-management-req">privilege</DocLink> to access the **Endpoints** page.
24+
====
25+
26+
[discrete]
27+
[[security-before-you-begin]]
28+
== Before you begin
29+
30+
If you're using macOS, some versions may require you to grant Full Disk Access to different kernels, system extensions, or files. Refer to <<security-elastic-endpoint-deploy-reqs>> for more information.
31+
32+
[NOTE]
33+
====
34+
{elastic-defend} does not support deployment within an {agent} DaemonSet in Kubernetes.
35+
====
36+
37+
[discrete]
38+
[[add-security-integration]]
39+
== Add the {elastic-defend} integration
40+
41+
. Go to the **Integrations** page, which you can access in several ways:
42+
+
43+
** The **Add integrations** link at the top of most pages
44+
** **Assets** → **Browse Integrations**
45+
** **Project settings** → **Integrations**
46+
+
47+
[role="screenshot"]
48+
image::images/install-endpoint/-getting-started-install-endpoint-endpoint-cloud-sec-integrations-page.png[Search result for "{elastic-defend}" on the Integrations page.]
49+
. Search for and select **{elastic-defend}**, then select **Add {elastic-defend}**. The integration configuration page appears.
50+
+
51+
[NOTE]
52+
====
53+
If this is the first integration you've installed and the **Ready to add your first integration?** page appears instead, select **Add integration only (skip agent installation)** to proceed. You can <<enroll-agent,install {agent}>> after setting up the {elastic-defend} integration.
54+
====
55+
+
56+
[role="screenshot"]
57+
image:images/install-endpoint/-getting-started-install-endpoint-endpoint-cloud-security-configuration.png[Add {elastic-defend} integration page]
58+
. Configure the {elastic-defend} integration with an **Integration name** and optional **Description**.
59+
. Select the type of environment you want to protect, either **Traditional Endpoints** or **Cloud Workloads**.
60+
. Select a configuration preset. Each preset comes with different default settings for {agent} — you can further customize these later by <<security-configure-endpoint-integration-policy,configuring the {elastic-defend} integration policy>>.
61+
+
62+
|===
63+
| |
64+
65+
| **Traditional Endpoint presets**
66+
a| All traditional endpoint presets _except_ **Data Collection** have these preventions enabled by default: malware, ransomware, memory threat, malicious behavior, and credential theft. Each preset collects the following events:
67+
68+
* **Data Collection:** All events; no preventions
69+
* **Next-Generation Antivirus (NGAV):** Process events; all preventions
70+
* **Essential EDR (Endpoint Detection & Response):** Process, Network, File events; all preventions
71+
* **Complete EDR (Endpoint Detection & Response):** All events; all preventions
72+
73+
| **Cloud Workloads presets**
74+
a| Both cloud workload presets are intended for monitoring cloud-based Linux hosts. Therefore, <<security-session-view,session data>> collection, which enriches process events, is enabled by default. They both have all preventions disabled by default, and collect process, network, and file events.
75+
76+
* **All events:** Includes data from automated sessions.
77+
* **Interactive only:** Filters out data from non-interactive sessions by creating an <<security-event-filters,event filter>>.
78+
|===
79+
. Enter a name for the agent policy in **New agent policy name**. If other agent policies already exist, you can click the **Existing hosts** tab and select an existing policy instead. For more details on {agent} configuration settings, refer to {fleet-guide}/agent-policy.html[{agent} policies].
80+
. When you're ready, click **Save and continue**.
81+
. To complete the integration, select **Add {agent} to your hosts** and continue to the next section to install the {agent} on your hosts.
82+
83+
[discrete]
84+
[[enroll-security-agent]]
85+
== Configure and enroll the {agent}
86+
87+
To enable the {elastic-defend} integration, you must enroll agents in the relevant policy using {fleet}.
88+
89+
[IMPORTANT]
90+
====
91+
Before you add an {agent}, a {fleet-server} must be running. Refer to {fleet-guide}/add-a-fleet-server.html[Add a {fleet-server}].
92+
93+
{elastic-defend} cannot be integrated with an {agent} in standalone mode.
94+
====
95+
96+
[discrete]
97+
[[enroll-agent]]
98+
=== Add the {agent}
99+
100+
. If you're in the process of installing an {agent} integration (such as {elastic-defend}), the **Add agent** UI opens automatically. Otherwise, go to **Assets** → **{fleet}** → **Agents** → **Add agent**.
101+
+
102+
[role="screenshot"]
103+
image::images/install-endpoint/-getting-started-install-endpoint-endpoint-cloud-sec-add-agent.png[Add agent flyout on the Fleet page.]
104+
. Select an agent policy for the {agent}. You can select an existing policy, or select **Create new agent policy** to create a new one. For more details on {agent} configuration settings, refer to {fleet-guide}/agent-policy.html[{agent} policies].
105+
+
106+
The selected agent policy should include the integration you want to install on the hosts covered by the agent policy (in this example, {elastic-defend}).
107+
+
108+
[role="screenshot"]
109+
image:images/install-endpoint/-getting-started-install-endpoint-endpoint-cloud-sec-add-agent-detail.png[Add agent flyout with {elastic-defend} integration highlighted.]
110+
. Ensure that the **Enroll in {fleet}** option is selected. {elastic-defend} cannot be integrated with {agent} in standalone mode.
111+
. Select the appropriate platform or operating system for the host, then copy the provided commands.
112+
. On the host, open a command-line interface and navigate to the directory where you want to install {agent}. Paste and run the commands from {fleet} to download, extract, enroll, and start {agent}.
113+
. (Optional) Return to the **Add agent** flyout in {fleet}, and observe the **Confirm agent enrollment** and **Confirm incoming data** steps automatically checking the host connection. It may take a few minutes for data to arrive in {es}.
114+
. After you have enrolled the {agent} on your host, you can click **View enrolled agents** to access the list of agents enrolled in {fleet}. Otherwise, select **Close**.
115+
+
116+
The host will now appear on the **Endpoints** page in the {security-app}. It may take another minute or two for endpoint data to appear in {elastic-sec}.
117+
. For macOS, continue with <<security-install-endpoint-manually,these instructions>> to grant {elastic-endpoint} the required permissions.

0 commit comments

Comments
 (0)