[Defend Workflows] Endpoints count Mismatch Due to Filter Applied by the Policies Tab for Endpoints.

[sukhwindersingh-qasource]

Describe the bug:

• Endpoints count Mismatch Due to Filter Applied by the Policies Tab for Endpoints.

Build Details:

VERSION: 8.16.0 BC1 BUILD: 79314 COMMIT: 5575428dd3aef69366cddb4ccf07a2a26d30ce48

Login Credentials

• https://p.elstc.co/paste/PWcOiBRV#AKA5tbvJri4N1xefGriNh2mgOxo6kaUdExQM8pnfQMt

Preconditions

• Kibana should be running.
• Agents should be added

Steps to Reproduce

• Create a policy with name DEFEND add 4 agents to that.
• Now Delete this DEFEND Integration
• Add the new defend Integration in the same policy, lets say Defend 3
• Add one more agent with the defend 3
• When you Navigate to the Policies tab, it shows 5 Endpoints
• But when you click on the 5 navigation Link , it will apply the filter united.endpoint.Endpoint.policy.applied.id : "b0a8b1d4-242c-4b3b-ad70-3ffb8a9642c0"
• It will only show 1 Endpoint.

Actual result

• Endpoints count Mismatch Due to Filter Applied by the Policies Tab for Endpoints.

Expected Result

• Filter added Count should match the count with the number of Endpoints are shown on the Policies page

Screen-cast

https://github.com/user-attachments/assets/2d87139f-7248-4fb2-b68c-f2c933cd7b66

Logs

• N/A

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-defend-workflows (Team:Defend Workflows)

[muskangulati-qasource]

Reviewed and assigned to @dasansol92

[dasansol92]

@sukhwindersingh-qasource thanks for raising this. As I can see, we are filtering by policy id in the endpoints list. Did you wait enough time for the transforms to update that list? Were the initial 4 enrolled agents still enrolled and online at the time you clicked on the number of hosts (5) at policy list page?

@pzl @joeypoon any other thoughts why that search is not returning the total list of enrolled endpoints (5)?

Thanks!

[sukhwindersingh-qasource]

Hi @dasansol92,

Thanks for the updates.

We tested on a single VM by installing/uninstalling agents to check the agent count. However, the transforms were not updated for the old entries since it was the same host. We tried it with multiple live hosts, waited for the transform updates, and observed that everything worked fine once the transforms were updated.

Screen Cast:

https://github.com/user-attachments/assets/d6192af6-6d46-431d-9565-1ecfd2b93c95

Hence, we are closing this ticket as it is now working fine.

Thanks!