Frequently asked questions and troubleshooting steps for Elastic Security's agentless integrations.

After you create a new agentless integration, the new integration policy may show a button that saysAdd agent instead of the associated agent for several minutes during agent enrollment. No action is needed other than refreshing the page once enrollment is complete.

Agentless agents (which run on Elastic's infrastructure to enable agentless integrations) do not appear on theFleet page by default. To view them on this page:

For agentless integrations to successfully connect to Elastic Security, the Fleet server host value must be the default. Otherwise, the agent status on the Fleet page will beOffline, and logs will include the error[elastic_agent][error] Cannot checkin in with fleet-server, retrying.

To troubleshoot this issue:

1. FindFleet in the navigation menu or use theglobal search field. Go to theSettings tab.
2. UnderFleet server hosts, click theActions button for the policy namedDefault. This opens the Edit Fleet Server flyout. The policy namedDefault should have theMake this Fleet server the default one setting enabled. If not, enable it, then delete your integration and create it again.

If theMake this Fleet server the default one setting was already enabled but problems persist, it’s possible someone changed the default Fleet server’sURL value. In this case, contact Elastic Support to find out what the originalURL value was, update the settings to match this value, then delete your integration and create it again.

On versions of Elastic Stack before v9.2, agentless integrations can't be upgraded to newer versions of the integration. To get a newer version in your Elastic Stack environment, upgrade to Elastic Stack v9.2+ or delete and re-install the desired integration.

On theFleet page, agents associated with agentless integrations have names that begin withagentless. To troubleshoot anUnhealthy agent:

1. Go to theSettings tab of theFleet page. Go to theAdvanced Settings section, and turn on theShow agentless resources toggle.
2. In Fleet, select the unhealthy agent.
3. From theActions menu, selectRequest diagnostics .zip.
4. Download and unzip thediagnostics bundle. Refer toCommon problems with Fleet and Elastic Agent for more information.

When you create a new agentless integration, a new agent policy appears within theAgent policies tab on theFleet page, but you can’t use theDelete integration button on this page. Instead, you must delete the integration from the Integration’sIntegration policies tab.

1. FindIntegrations in the navigation menu or use theglobal search field, then search for your integration.
2. Go to the integration’sIntegration policies tab.
3. Find the integration policy for the integration you want to delete. ClickActions, thenDelete integration.
4. Confirm by clickingDelete integration again.

No, agentless integrations can not use a specific range of static IP addresses for configuring ingress and egress allow and deny rules.