Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Fleet] Expose API that gives insight into status on different Integrations added to Agent #74708

Open
kevinlog opened this issue Aug 10, 2020 · 2 comments
Labels
Feature:Fleet Fleet team's agent central management project Team:Defend Workflows “EDR Workflows” sub-team of Security Solution Team:Fleet Team label for Observability Data Collection Fleet team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.

Comments

@kevinlog
Copy link
Contributor

kevinlog commented Aug 10, 2020

Describe the feature:
Ingest/Fleet maintains several different Integrations that are added to an Agent. Support for more detailed information regarding each Integration/Package on a particular Agent would be helpful for other plugins using Ingest.

At a minimum:

  • Return Integrations/Packages added to Agent
  • Return latest status from a particular Integration/Package (i.e. an Error from Endpoint)
  • Return state updates from a particular Integration/Package (i.e. Starting, Running from Endpoint)

The latest status will help us understand when the Agent is reporting an Error from the Endpoint so that we can provide more insight in the Security app or prompt a user to look at the Agent logs.

The state updates could help us figure out if an Endpoint is Starting. This would allow us to let users know in the Security app if Endpoints are starting up before we get the first docs. Similarly, we'd be able to know if the Endpoint is running, in general.

Example of "Status" (note Error, Running State, Starting, State):
image

Describe a specific use case for the feature:
When users want to drill down to see the status of a certain Integration, they want to see an "at a glance" view of that status.

For example, a user view a list of all Agents running Endpoint. They want to see if any Endpoints have reported an Error to the Agent. Then, they can filter down to just the list of Agents with an Error state from Endpoint and drill further into logs.

@kevinlog kevinlog changed the title Ingest API that give insight into status on different Integrations added to Agent Ingest API that gives insight into status on different Integrations added to Agent Aug 10, 2020
@kevinlog kevinlog added the Feature:Fleet Fleet team's agent central management project label Aug 10, 2020
@elasticmachine
Copy link
Contributor

Pinging @elastic/ingest-management (Feature:Fleet)

@kevinlog kevinlog added the Team:Fleet Team label for Observability Data Collection Fleet team label Aug 10, 2020
@elasticmachine
Copy link
Contributor

Pinging @elastic/endpoint-management (Team:Endpoint Management)

@ruflin ruflin removed their assignment Aug 18, 2020
@ph ph assigned nchaulet and unassigned ph and kevinlog Oct 19, 2020
@ph ph added the v7.11.0 label Oct 19, 2020
@MindyRS MindyRS added Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Defend Workflows “EDR Workflows” sub-team of Security Solution and removed Team:Endpoint Management labels Oct 27, 2020
@ph ph unassigned nchaulet Feb 15, 2021
@ph ph removed the v7.11.0 label Feb 15, 2021
@jen-huang jen-huang changed the title Ingest API that gives insight into status on different Integrations added to Agent [Fleet] Expose API that gives insight into status on different Integrations added to Agent Apr 27, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Feature:Fleet Fleet team's agent central management project Team:Defend Workflows “EDR Workflows” sub-team of Security Solution Team:Fleet Team label for Observability Data Collection Fleet team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.
Projects
None yet
Development

No branches or pull requests

6 participants