Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[8.14] Document how to troubleshoot Defend's self-healing feature on Windows (backport #6361) #6389

Merged
merged 2 commits into from
Jan 6, 2025
Merged

[8.14] Document how to troubleshoot Defend's self-healing feature on Windows (backport #6361) #6389

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
91285d8
Document how to troubleshoot Defend's self-healing feature on Windows…
natasha-moore-elastic Jan 6, 2025
ba29617
Delete docs/serverless directory and its contents
github-actions[bot] Jan 6, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 28 additions & 0 deletions docs/troubleshooting/ts-management.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -222,4 +222,32 @@ sudo /Library/Elastic/Endpoint/elastic-endpoint test install

If the command output doesn't contain a message about enabling Full Disk Access, the approval was successful.

====

[discrete]
[[disable-self-healing]]
.Disable {elastic-defend}'s self-healing feature on Windows
[%collapsible]
====

[discrete]
[[self-healing-vss-issues]]
==== Volume Snapshot Service issues

{elastic-defend}'s self-healing feature rolls back recent filesystem changes when a prevention alert is triggered. This feature uses the Windows Volume Snapshot Service. Although it's uncommon for this to cause issues, you can turn off this {elastic-defend} feature if needed.

If issues occur and the self-healing feature is enabled, you can turn it off by setting `windows.advanced.alerts.rollback.self_healing.enabled` to `false` in the integration policy advanced settings. Refer to <<self-healing-rollback>> for more information.

{elastic-defend} may also use the Volume Snapshot Service to ensure the feature works properly even when it's turned off. To opt out of this, set `windows.advanced.diagnostic.rollback_telemetry_enabled` to `false` in the same settings.

[discrete]
[[self-healing-compatibility-issues]]
==== Known compatibility issues

There are some known compatibility issues between {elastic-defend}'s self-healing feature and filesystem replication features, including https://learn.microsoft.com/en-us/windows-server/storage/dfs-replication/dfsr-overview[DFS Replication] and Veeam Replication. This may manifest as `DFSR Event ID 1102`:

`The DFS Replication service has temporarily stopped replication because another application is performing a backup or restore operation. Replication will resume after the backup or restore operation has finished.`

There are no known workarounds for this issue other than to turn off the self-healing feature.

====