Configure and install Elastic Endpoint integration

Like other Elastic integrations, Endpoint Security can be integrated into the Elastic Agent through Fleet. Upon configuration, the integration allows the Elastic Agent to monitor for events on your host and send data to the Elastic Security app.

Depending on the macOS version you’re using, macOS requires that you give full disk access to different kernels, system extensions, or files. See Enable Full Disk Access for more information.

When integrating with the Elastic Agent, Endpoint Security requires enrollment through Fleet to enable the integration.

After you have enrolled the Elastic Agent on your host, select Continue. The host now appears in the Endpoints list, located on the Administration page in the Elastic Security app.

To unenroll an agent from your host, see Unenroll Elastic Agent.

When running the Elastic Agent with endpoint integrated on macOS 10.13, 10.14 and 10.15, you will be prompted to approve a kernel extension from "Endgame, Inc". To approve the extension:

If the prompt does not appear because you’re using a version earlier than macOS Big Sur (11.0), enable the extension by doing the following:

After the Elastic Agent is installed successfully, malware prevention and ransomware prevention (a Platinum+ license feature) are automatically enabled on protected hosts. If needed, you can update the Integration Policy to configure malware protection, ransomware protection, event collection, and antivirus settings to meet your company’s security needs.

To access the Integration Policy:

Malware prevention on the Elastic Agent detects and stops malicious attacks by using a machine learning model that looks for static attributes to determine if a file is malicious or benign.

By default, malware protection is enabled on Windows and macOS hosts. To disable malware protection, switch the Malware protections enabled toggle off. Malware protection levels are as follows:

Behavioral ransomware prevention on the Elastic Agent detects and stops ransomware attacks on Windows systems by analyzing data from low-level system processes, and is effective across an array of widespread ransomware families — including those targeting the system’s master boot record.

Ransomware protection is a paid feature and is enabled by default if you have a Platinum or Enterprise license. If you upgrade to a Platinum+ license from Basic or Gold, ransomware protection will be disabled by default.

Ransomware protection levels are as follows:

In the Settings section, review the events that collect data on each operating system. By default, all event data is collected. If you no longer want a specific event to collect data, deselect it.

If you download the Elastic Agent version 7.10 or later on Windows 7 or above, you can configure Elastic Security as your antivirus software switching the Register as antivirus toggle on.

Users who have unique configuration and security requirements can select Show Advanced Settings to configure the Policy to support advanced use cases. Hover over each setting to view its description.

After installing the Elastic Agent, there’s a lag time of several hours between when the Elastic Endpoint begins detecting and sending alerts to Kibana. To ensure that the installation of Elastic Endpoint on your host was successful, go to Administration > Endpoints. A message appears that says, "Endpoints are enrolling. View agents to track progress". Select View agents to check the status of your endpoint enrollment.