system.security dataset is not generated for Windows agent installed with unprivileged flag.

[amolnater-qasource]

Kibana Build details:

VERSION: 8.14.0 BC2
BUILD: 73626
COMMIT: bcf6960778ae270d0894a8aab07f10197ee9b97f

Preconditions:

1. 8.14.0-BC2 Kibana cloud environment should be available.
2. Agent should be installed with unprivileged flag.

Steps to reproduce:

1. Navigate to Data Streams tab.
2. Observe logs for system integration and system.security dataset is not generated.

Expected Result:
system.security dataset should be generated for Windows agent installed with unprivileged flag.

What's working fine:

• system.security dataset is generated for Windows agent installed without unprivileged flag.

Screenshot:

[elasticmachine]

Pinging @elastic/elastic-agent-control-plane (Team:Elastic-Agent-Control-Plane)

[amolnater-qasource]

@karanbirsingh-qasource Please review.

[ghost]

secondary review is done

[cmacknz]

I suspect this will be related to the permissions of the new unprivileged user.

Can you upload diagnostics when this happens?

[leehinman]

odds are really good that the new unprivileged user needs to be a member of the "Event Log Readers" group.

[blakerouse]

It was agreed that the Administrator performing the installation will add the elastic-agent-user to the groups that they want the Elastic Agent to have access to.

I don't know exactly which group is needed to read that data, so I would try @leehinman suggestion.

[amolnater-qasource]

Hi Team,

Thank you for looking into this issue.

Please find below agent diagnostics for the installed agent:
elastic-agent-diagnostics-2024-05-02T06-10-30Z-00.zip

Please let us know if anything else is required from our end.
Thanks!!

[nimarezainia]

It was agreed that the Administrator performing the installation will add the elastic-agent-user to the groups that they want the Elastic Agent to have access to.

I don't know exactly which group is needed to read that data, so I would try @leehinman suggestion.

@blakerouse are there any other steps during installation that the user needs to perform? not just for this issue but generally speaking. I want to make sure we can comprehensively document these.

cc: @kilfoyle

[ycombinator]

@amolnater-qasource Did you get a chance to try @leehinman's suggestion? If it works, we can document it as a pre-requisite for running Agent in unprivileged mode.

[ycombinator]

@nimarezainia @blakerouse @kilfoyle I've created #4705 to start collecting in a single place all prerequisites required for successfully running Agent in unprivileged mode. @blakerouse could you please populate the table in that issue as you discover prerequisites? @kilfoyle your call on how best to take the information in that table and present it in our user-facing documentation. Thanks!

[nimarezainia]

thank you @ycombinator. We would need instructions on how the user could change the privilege level (that are OS specific) for some of the major operating systems.

the use case: In Fleet, we inform the user that an input is not working due to privilege. The idea was to provide them some instructions on how to change the priv level to be able to read the data source.