Open maximpn opened 3 days ago
Pinging @elastic/security-solution (Team: SecuritySolution)
Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)
Pinging @elastic/security-detections-response (Team:Detections and Resp)
Summary
In some cases rule integrations are shown being disabled while Fleet UI says integrations are enabled. Where enabled integrations have agent policies installed.
Details
Preliminary research revealed that functionality for integrations status calculation fetches only the first page of policies (which is 20 items per page by default). Occasionally an agent policy might be on a second or further pages which will be considered as that integration is disabled. Code chunk fetching agent policies for status calculation can be found here
To fix the problem we need to all agent policies.
Steps to reproduce
ER: All installed integrations are shown as enabled AR: Some of the installed integrations are shown as disabled