Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Creates agentless CSPM troubleshooting page #6179

Closed
wants to merge 2,184 commits into from

Conversation

benironside
Copy link
Contributor

@benironside benironside commented Nov 19, 2024

Fixes #6044 — creates a troubleshooting page for the new agentless integration.

Preview: Agentless integrations FAQ

nastasha-solomon and others added 30 commits May 13, 2024 15:04
#341)

* First draft

* Refreshing screenshots

* Refreshed gif

* Fixed reference

* Fixed ref and formatting

* Re-adds screenshot

* Re-refreshed images

* ESQL image
…to GA (#5139)

* Removing notes for tab and ES|QL

* Removed tech preview note

* Refreshed images

* Updates gif

* Re-added intro

* First batch of re-refreshed images

* Updated ES|QL tab image
* Adds LLM connector step-by-step guides

* minor edits

* fix heading sizes

* finishes UI updates for AI Assistant page

* troubleshoot embedded video

* updates video embeds

* updates old gif

* Incorporates Dhru's feedback

* incorporates Joe's feedback on openAI onboarding doc

* Update docs/assistant/ai-assistant.mdx

Co-authored-by: Joe Peeples <[email protected]>

* Update docs/assistant/ai-assistant.mdx

Co-authored-by: Joe Peeples <[email protected]>

---------

Co-authored-by: Joe Peeples <[email protected]>
* incorporates Dhru's first review

* Adds page for OpenAI connector setup

* Minor edit

* Update docs/assistant/connect-to-openai.asciidoc

Co-authored-by: Joe Peeples <[email protected]>

* Update docs/assistant/connect-to-openai.asciidoc

Co-authored-by: Joe Peeples <[email protected]>

* removes unused image

---------

Co-authored-by: Joe Peeples <[email protected]>
* creates stub page

* updates feature name

* update screenshot

* Adds Attack Discovery ESS page

* adds attack discovery to index

* troubleshoots build error

* troubleshoots ToC issue

* troubleshoots build errors

* incorporates Joe's edits

---------

Co-authored-by: Janeen Mikell Roberts <[email protected]>
* first draft

* troubleshoots docnav

* updates Docnav

* incorporates Dhru's feedback

* minor edits

* line edit

* Removes unnecessary link

* Update docs/attack-discovery/attack-discovery.mdx

Co-authored-by: Janeen Mikell Roberts <[email protected]>

* Update docs/attack-discovery/attack-discovery.mdx

Co-authored-by: Janeen Mikell Roberts <[email protected]>

* Update docs/attack-discovery/attack-discovery.mdx

Co-authored-by: Janeen Mikell Roberts <[email protected]>

* Update docs/attack-discovery/attack-discovery.mdx

Co-authored-by: Janeen Mikell Roberts <[email protected]>

* Update docs/attack-discovery/attack-discovery.mdx

Co-authored-by: Janeen Mikell Roberts <[email protected]>

* Update docs/attack-discovery/attack-discovery.mdx

Co-authored-by: Janeen Mikell Roberts <[email protected]>

* Update docs/attack-discovery/attack-discovery.mdx

Co-authored-by: Janeen Mikell Roberts <[email protected]>

* Update docs/attack-discovery/attack-discovery.mdx

Co-authored-by: Janeen Mikell Roberts <[email protected]>

* incorporates Janeen's review

* Update docs/attack-discovery/attack-discovery.mdx

Co-authored-by: Nastasha Solomon <[email protected]>

* incorporates Nastasha's feedback

* removes unnecessary link

* Incorporates Joe's review

* Adds note to AI Assistant page

* fixes note

* minor updates

* moves period

* adds missing "to"

* Incorporates Janeen's feedback

---------

Co-authored-by: Janeen Mikell Roberts <[email protected]>
Co-authored-by: Nastasha Solomon <[email protected]>
* First draft

* Hide note (doesn't apply to serverless?)

* Update docs/rules/rules-ui-create.mdx

Co-authored-by: Nastasha Solomon <[email protected]>

* Remove hidden note

* Revise alert suppression refs of max_signals

* Fix repetition typo

* Update docs/alerts/alert-suppression.mdx

Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

---------

Co-authored-by: Nastasha Solomon <[email protected]>
Co-authored-by: Benjamin Ironside Goldstein <[email protected]>
…ess - main docs (#340)

* First draft

* Fix icon

* Update docs/rules/rules-ui-create.mdx

* Updated comment

* Bringing note to parity

* Updated comment with plan

* Fixing 5150

Addresses #5150

* Add "related integrations" to ESQL rule steps

* Revise per "max alerts per run" setting

* Remove note

* Update docs/rules/rules-ui-create.mdx

Co-authored-by: natasha-moore-elastic <[email protected]>

* Update docs/rules/rules-ui-create.mdx

Co-authored-by: natasha-moore-elastic <[email protected]>

* Update docs/rules/rules-ui-create.mdx

Co-authored-by: natasha-moore-elastic <[email protected]>

* Update docs/rules/rules-ui-create.mdx

Co-authored-by: natasha-moore-elastic <[email protected]>

* Update docs/rules/rules-ui-create.mdx

Co-authored-by: natasha-moore-elastic <[email protected]>

* Update docs/rules/rules-ui-create.mdx

Co-authored-by: natasha-moore-elastic <[email protected]>

* Update docs/rules/rules-ui-create.mdx

* Update docs/rules/rules-ui-create.mdx

---------

Co-authored-by: Joe Peeples <[email protected]>
Co-authored-by: natasha-moore-elastic <[email protected]>
* Adds pricing table to billing dimensions page

* Update docs/billing.mdx

* Update docs/billing.mdx

Co-authored-by: Joe Peeples <[email protected]>

* Corrects variable

---------

Co-authored-by: Joe Peeples <[email protected]>
* First draft

* update metadata for API create

* Nat's edits

---------

Co-authored-by: Vitalii Dmyterko <[email protected]>
…343)

* Documents risk score recalculation when asset criticality is changed

* Corrects information about bulk assignment

* Update docs/advanced-entity-analytics/asset-criticality.mdx

* Update docs/advanced-entity-analytics/asset-criticality.mdx

Co-authored-by: Nastasha Solomon <[email protected]>

---------

Co-authored-by: Nastasha Solomon <[email protected]>
* First draft

* Update configure-integration-policy.asciidoc

* Apply suggestions from review

Co-authored-by: Gabriel Landau <[email protected]>

* Apply suggestions from review

Co-authored-by: Nastasha Solomon <[email protected]>

---------

Co-authored-by: Gabriel Landau <[email protected]>
Co-authored-by: Nastasha Solomon <[email protected]>
* First draft

* Rename to "event capture"

* Apply suggestions from review

Co-authored-by: Nastasha Solomon <[email protected]>

---------

Co-authored-by: Nastasha Solomon <[email protected]>
* Update docs for `required_fields`

* Update docs/detections/api/rules/rules-api-create.asciidoc

Co-authored-by: Joe Peeples <[email protected]>

* Update docs/detections/api/rules/rules-api-update.asciidoc

Co-authored-by: Joe Peeples <[email protected]>

---------

Co-authored-by: Joe Peeples <[email protected]>
* Updates government cloud support description

* Adds detail

* updates punctuation

* updates request support link

* Incorporates Smriti's feedback
* Refreshes screenshots, updates model recommendation note, and adds technical preview tag and note

* tweaks technical preview note

* Updates generate discoveries section

* minor reorg

* minor edits

* minor edit

* Update docs/attack-discovery/attack-discovery.mdx

Co-authored-by: Joe Peeples <[email protected]>

* Update docs/attack-discovery/attack-discovery.mdx

Co-authored-by: Joe Peeples <[email protected]>

* Update docs/attack-discovery/attack-discovery.mdx

Co-authored-by: Joe Peeples <[email protected]>

* fixes image

* removes weird gif

* crops gif

---------

Co-authored-by: Joe Peeples <[email protected]>
* First draft

* Fixing icons

* Fixed refs to icons

* Update docs/detections/value-list-exceptions.asciidoc

* Update docs/detections/value-list-exceptions.asciidoc

Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

* Update docs/detections/value-list-exceptions.asciidoc

Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

---------

Co-authored-by: Benjamin Ironside Goldstein <[email protected]>
* Fixed links

* First draft

* Adding's ben's input
… ES|QL in ESS (#5181)

* First draft

* Minor edits

* Updated note

* Removing outdated content

* Update docs/assistant/security-assistant.asciidoc

* Update docs/detections/about-rules.asciidoc

* Update docs/events/timeline-ui-overview.asciidoc

* Fixed formatting
…ds (#349)

* First draft

* ben's edit

* Pt two of Ben's edits

* Re-adding changes

Need to add in 348

* Update docs/rules/rules-ui-create.mdx

* Update docs/rules/rules-ui-create.mdx

* Update docs/rules/rules-ui-create.mdx
)

* First draft

* Additional information

* Small edits

* Part of Vitalii's feedback

* Re-orged info

* Re-adding into sen

* Update docs/detections/rules-ui-create.asciidoc

* Update docs/detections/rules-ui-create.asciidoc

* Draft of Vitalii's input

* Update docs/detections/rules-ui-create.asciidoc

* Expanding definition for new fields

* Update docs/detections/rules-ui-create.asciidoc

* Update docs/detections/rules-ui-create.asciidoc

* Update docs/detections/rules-ui-create.asciidoc

Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

* Update docs/detections/rules-ui-create.asciidoc

Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

* Update docs/detections/rules-ui-create.asciidoc

Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

* Update docs/detections/rules-ui-create.asciidoc

Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

* Update docs/detections/rules-ui-create.asciidoc

* Update docs/detections/rules-ui-create.asciidoc

* Update docs/detections/rules-ui-create.asciidoc

---------

Co-authored-by: Benjamin Ironside Goldstein <[email protected]>
…docs (#311)

* First draft

* Yara's input

* Adding updated text
…r alert suppression (#5122)

* First draft

* Update docs/detections/alert-suppression.asciidoc
…ered for alert suppression (#334)

* First draft

* One more edit

* Minor revision

* Update docs/alerts/alert-suppression.mdx

* Update docs/alerts/alert-suppression.mdx

Co-authored-by: Joe Peeples <[email protected]>

---------

Co-authored-by: Joe Peeples <[email protected]>
natasha-moore-elastic and others added 13 commits November 12, 2024 15:47
* Whats new in 8.16

* Adds screenshots

* Update docs/whats-new.asciidoc

Co-authored-by: Nastasha Solomon <[email protected]>

* Comment out endpoint rules

* Add links

* comment out screenshot

* Add more links

---------

Co-authored-by: Nastasha Solomon <[email protected]>
…tures by default (#6134)

* Align with ESS on nav steps

* Add admonition for emphasis
* 8.16 Elastic Security Release Notes

* Adds 8.16 rns to index file

* Completes first draft

* Including 8.16 rn file

* minor updates

* First draft of Endpoint PRs

* First batch of endpoint revisions

* Second batch of edits for Endpoint PRs

* Edits endpoint, DE, and TH rns

* More minor edits

* Update docs/release-notes/8.16.asciidoc

Co-authored-by: natasha-moore-elastic <[email protected]>

* Update docs/release-notes/8.16.asciidoc

Co-authored-by: natasha-moore-elastic <[email protected]>

* Update docs/release-notes/8.16.asciidoc

Co-authored-by: natasha-moore-elastic <[email protected]>

* Update docs/release-notes/8.16.asciidoc

Co-authored-by: Gabriel Landau <[email protected]>

* Update docs/release-notes/8.16.asciidoc

Co-authored-by: Gabriel Landau <[email protected]>

* Update docs/release-notes/8.16.asciidoc

* Update docs/release-notes/8.16.asciidoc

* Update docs/release-notes/8.16.asciidoc

Co-authored-by: Georgii Gorbachev <[email protected]>

* Update docs/release-notes/8.16.asciidoc

* Update docs/release-notes/8.16.asciidoc

* Update docs/release-notes/8.16.asciidoc

* Adds Automatic Import PRs

* Update docs/release-notes/8.16.asciidoc

Co-authored-by: Gabriel Landau <[email protected]>

* Update docs/release-notes/8.16.asciidoc

* Update docs/release-notes/8.16.asciidoc

* jatin's feedback

* Update docs/release-notes/8.16.asciidoc

* Adding known manual run issues

* Update docs/release-notes/8.16.asciidoc

Co-authored-by: Eric Beahan <[email protected]>

* Fix title

* Adds knowledge base index known error

* Update docs/release-notes/8.16.asciidoc

* Re-orders new features

* Edits and summary for 191874

* Grammar and re-orders enh and bf

* Re-orders known issues

* Update docs/release-notes/8.16.asciidoc

Co-authored-by: Joe Peeples <[email protected]>

* Update docs/release-notes/8.16.asciidoc

Co-authored-by: Joe Peeples <[email protected]>

* Update docs/release-notes/8.16.asciidoc

Co-authored-by: Joe Peeples <[email protected]>

* Update docs/release-notes/8.16.asciidoc

Co-authored-by: Joe Peeples <[email protected]>

* adds cloud sec integrations

* Update docs/release-notes/8.16.asciidoc

Co-authored-by: Janeen Mikell Roberts <[email protected]>

* Update docs/release-notes/8.16.asciidoc

Co-authored-by: Janeen Mikell Roberts <[email protected]>

* Update docs/release-notes/8.16.asciidoc

Co-authored-by: Janeen Mikell Roberts <[email protected]>

* Update docs/release-notes/8.16.asciidoc

Co-authored-by: Janeen Mikell Roberts <[email protected]>

* Update docs/release-notes/8.16.asciidoc

Co-authored-by: Janeen Mikell Roberts <[email protected]>

* Update docs/release-notes/8.16.asciidoc

Co-authored-by: Janeen Mikell Roberts <[email protected]>

* Update docs/release-notes/8.16.asciidoc

Co-authored-by: Janeen Mikell Roberts <[email protected]>

* Update docs/release-notes/8.16.asciidoc

Co-authored-by: Janeen Mikell Roberts <[email protected]>

* Update docs/release-notes/8.16.asciidoc

Co-authored-by: Janeen Mikell Roberts <[email protected]>

* Updates summary for 191557

---------

Co-authored-by: nastasha.solomon <[email protected]>
Co-authored-by: Nastasha Solomon <[email protected]>
Co-authored-by: natasha-moore-elastic <[email protected]>
Co-authored-by: Gabriel Landau <[email protected]>
Co-authored-by: Georgii Gorbachev <[email protected]>
Co-authored-by: Eric Beahan <[email protected]>
Co-authored-by: Joe Peeples <[email protected]>
Co-authored-by: Janeen Mikell Roberts <[email protected]>
… (#6156)

the driver and ELAM paths were inverted

Co-authored-by: Janeen Mikell Roberts <[email protected]>
(cherry picked from commit d5af583)

Co-authored-by: Thomas Youngs <[email protected]>
* First draft

* Update 8.16.asciidoc

* removed 0

* Mike's suggestions

* Style edits

* bolds page name

* Update docs/release-notes/8.16.asciidoc

Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

* Update docs/release-notes/8.16.asciidoc

Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

---------

Co-authored-by: Benjamin Ironside Goldstein <[email protected]>
…xecution` advanced setting (#5962)

* First draft

* Updating IM rules

* disclaimer about certain rule types and shards

* Minor tweak to dsl query docs

* Update docs/detections/detection-engine-intro.asciidoc

Co-authored-by: Marshall Main <[email protected]>

* Update docs/detections/detections-exclude-cold-frozen-data-tiers.asciidoc

Co-authored-by: Marshall Main <[email protected]>

* Update docs/getting-started/advanced-setting.asciidoc

Co-authored-by: Marshall Main <[email protected]>

* Update docs/release-notes/8.16.asciidoc

Co-authored-by: Marshall Main <[email protected]>

* Marshall's suggestion

* Update docs/detections/detection-engine-intro.asciidoc

* Removes note that's no longer needed

* Moves file back to remove this change from the PR

* Update docs/detections/detections-exclude-cold-frozen-data-tiers.asciidoc

* Update docs/detections/detections-exclude-cold-frozen-data-tiers.asciidoc

* Updates what's new

* Fixed title

* Update docs/detections/detections-exclude-cold-frozen-data-tiers.asciidoc

* Update docs/detections/detections-exclude-cold-frozen-data-tiers.asciidoc

* Update docs/detections/detections-exclude-cold-frozen-data-tiers.asciidoc

* Update docs/getting-started/advanced-setting.asciidoc

* Update docs/getting-started/advanced-setting.asciidoc

* Update docs/whats-new.asciidoc

* Update docs/whats-new.asciidoc

* Update docs/release-notes/8.16.asciidoc

* Fixes a typo

* Minor wording adjustments

* Update docs/whats-new.asciidoc

Co-authored-by: Marshall Main <[email protected]>

* Update docs/release-notes/8.16.asciidoc

Co-authored-by: Marshall Main <[email protected]>

* Update docs/getting-started/advanced-setting.asciidoc

* Update docs/detections/detections-exclude-cold-frozen-data-tiers.asciidoc

Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

* Update docs/detections/detections-exclude-cold-frozen-data-tiers.asciidoc

Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

* Update docs/detections/detections-exclude-cold-frozen-data-tiers.asciidoc

Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

* Update docs/detections/detection-engine-intro.asciidoc

Co-authored-by: Yara Tercero <[email protected]>

---------

Co-authored-by: Marshall Main <[email protected]>
Co-authored-by: Benjamin Ironside Goldstein <[email protected]>
Co-authored-by: Yara Tercero <[email protected]>
Copy link

A documentation preview will be available soon.

Request a new doc build by commenting
  • Rebuild this PR: run docs-build
  • Rebuild this PR and all Elastic docs: run docs-build rebuild

run docs-build is much faster than run docs-build rebuild. A rebuild should only be needed in rare situations.

If your PR continues to fail for an unknown reason, the doc build pipeline may be broken. Elastic employees can check the pipeline status here.


NOTE: Deleting your integration will remove all associated resources and stop data ingestion.

When you create a new agentless CSPM integration, a new agent policy appears on the **Agent policies** tab of the **Fleet** page, but you can't use the **Delete integration** button on this page. Instead, delete delete the integration from the CSPM Integration policies page.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Extra "Delete in this line- Instead, delete delete the integration from the CSPM Integration policies page.

When you create a new agentless CSPM integration, a new agent policy appears on the **Agent policies** tab of the **Fleet** page, but you can't use the **Delete integration** button on this page. Instead, delete delete the integration from the CSPM Integration policies page.

. Find **Integrations** in the navigation menu or use the {kibana-ref}/introduction.html#kibana-navigation-search[global search field], then search for and select `CSPM`.
. On the CSPM integration page, go to the **Integation policies** tab.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

typo in Integation policies


*When I make a new integration, how long until the agent appears on the agent policies page?*

After you create a new agentless integration, the new integration policy may show a button that says **Add agent** instead of the associated agent for several minutes during agent enrolment. No action is needed other than refreshing the page once enrolment is complete.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

type: enrolment to enrollment

@benironside benironside deleted the 6044-agentless-troubleshooting branch November 19, 2024 16:58
@benironside benironside restored the 6044-agentless-troubleshooting branch November 19, 2024 17:57
@benironside benironside reopened this Nov 19, 2024
@acorretti acorretti force-pushed the 6044-agentless-troubleshooting branch from 75a4ff8 to 152f6bf Compare November 19, 2024 18:24
Copy link
Contributor

mergify bot commented Nov 19, 2024

This pull request is now in conflicts. Could you fix it @benironside? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b 6044-agentless-troubleshooting upstream/6044-agentless-troubleshooting
git merge upstream/main
git push upstream 6044-agentless-troubleshooting

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Request] Add agentless troubleshooting steps to Agentless doc