Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Suggestion] Document that Elastic Defend response actions don't work if an alternate cluster is being used for output #6012

Open
ferullo opened this issue Oct 28, 2024 · 0 comments
Assignees
Labels
Feature: Response actions also includes response console suggestion Suggestions to improve documentation Team: EDR Workflows Formerly Defend Workflows, Onboarding and Lifecycle Management v8.17.0 v8.18.0 v9.0.0

Comments

@ferullo
Copy link
Collaborator

ferullo commented Oct 28, 2024

What can we change to make the docs better?

Endpoint response actions don't work when a second/alternate cluster is used as the output target in Fleet. The issue is that response action state management information is in the primary cluster (the one with Fleet) but Endpoint writes actual result data to the alternate cluster. Until this is fixed, we should document it as a limitation.

cc @raqueltabuyo @caitlinbetz @dasansol92

Doc URL

Please include the doc URL and any other related information where applicable:
Doc URL:
Github issue link(s)/Other resources:

Which documentation set needs improvement?

ESS and serverless

Software version

This has been the case since cross cluster support has existed in Fleet and Response Actions have existed for Defend.

@ferullo ferullo added the suggestion Suggestions to improve documentation label Oct 28, 2024
@jmikell821 jmikell821 added Team: EDR Workflows Formerly Defend Workflows, Onboarding and Lifecycle Management Feature: Response actions also includes response console v8.17.0 v8.18.0 v9.0.0 labels Jan 15, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Feature: Response actions also includes response console suggestion Suggestions to improve documentation Team: EDR Workflows Formerly Defend Workflows, Onboarding and Lifecycle Management v8.17.0 v8.18.0 v9.0.0
Projects
None yet
Development

No branches or pull requests

3 participants