Automatic troubleshooting

Automatic troubleshooting helps you identify and resolve issues that could prevent Elastic Defend from working as intended. It provides actionable insights into the following common problem areas:

• Stack 9.2+ The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.2 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Serverless Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. Policy responses: Detect warnings or failures in Elastic Defend’s integration policies.
• Third-party antivirus (AV) software: Identify installed third-party antivirus (AV) products that may conflict with Elastic Defend.

This helps you resolve configuration errors, address incompatibilities, and ensure that your hosts remain protected.

Elastic Defend's integration policy statuses indicate whether protections are applied successfully to your hosts. Warnings or failures in these policies can weaken your security posture. Automatic troubleshooting helps you detect any issues and suggests remediation steps.

1. Find Endpoints in the navigation menu or use the global search field.
2. Click on an endpoint to open its details flyout.
3. Under Automatic Troubleshooting, select an LLM connector, or add a new one.
4. If you don't already have AI Assistant Knowledge Base enabled, click Setup Knowledge Base.
5. Once Knowledge Base is enabled, click Scan. After a brief processing period, any detected warnings or failures in policy responses will appear under Insights.

After a scan has completed, automatic troubleshooting suggests recommended next steps for each policy issue. These may include adjusting specific Elastic Defend policy settings or reviewing conflicting host configurations. Where available, click Learn more to the right of a result to open Elastic documentation, which provides more context and guidance for resolving the issue.

Third-party antivirus software installed on your hosts can interfere with Elastic Defend. To mitigate issues with running third-party AV alongside Elastic Defend, you first have to identify which AV is present.

After you’ve installed Elastic Defend on one or more hosts, you can use automatic troubleshooting to check whether your endpoints have third-party AV software installed. Using the same kinds of large language model (LLM) connectors as Elastic AI Assistant, automatic troubleshooting can analyze file event logs from your hosts to determine whether antivirus software is present. From there, you can address any incompatibilities to make sure your endpoints are protected.

1. Find Endpoints in the navigation menu or use the global search field.
2. Click on an endpoint to open its details flyout.
3. Under Automatic Troubleshooting, select an LLM connector, or add a new one.
4. Click Scan. After a brief processing period, any detected AV products will appear under Insights.

After a scan has completed, you can click the Create trusted app button to the right of a result to quickly add the associated AV program to Elastic Defend's trusted applications list. If the button is not clickable, you don’t have the required privilege.