Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Document how to troubleshoot/disable Endpoint's self healing feature on Windows #2830

Closed
ferullo opened this issue Jan 9, 2023 · 4 comments · Fixed by #6361
Closed

Document how to troubleshoot/disable Endpoint's self healing feature on Windows #2830

ferullo opened this issue Jan 9, 2023 · 4 comments · Fixed by #6361
Assignees
Labels
Effort: Medium Issues that take moderate but not substantial time to complete Priority: Medium Issues that have relevance, but aren't urgent Team: Endpoint Endpoint related issues troubleshooting Docs that belong in the Troubleshooting section v8.7.0

Comments

@ferullo
Copy link
Collaborator

ferullo commented Jan 9, 2023

Description

Endpoint has a self healing feature on Windows at the Enterprise subscription level (@roxana-gheorghe can you confirm I got the subscription level right?). When enabled, Endpoint will undo recent file system changes when prevention alerts are triggered. This feature uses Windows's Volume Snapshot Service service. Although it is uncommon for this to cause issues on computers, users can disable this Endpoint feature if needed.

There are two reasons Endpoint may use the Volume Snapshot Service. The first is if Enterprise users use the advanced policy option windows.advanced.alerts.rollback.self_healing.enabled to enable the prevention feature. If it was enabled and is causing issues it needs to be turned back off.

Endpoint may also use the Volume Snapshot Service as a part of Elastic's effort to ensure the feature works properly even when it isn't in enforcement mode. Users can explicitly opt out of that by setting the windows.advanced.diagnostic.rollback_telemetry_enabled option to false.

Notes

Can we document this as a new Endpoint troubleshooting page, unless there is somewhere else this information may be more relevant?

cc @nfritts @bit-envoy @joe-desimone to correct me if anything I stated is wrong.

@joepeeples joepeeples self-assigned this Jan 10, 2023
@joepeeples joepeeples added Team: Endpoint Endpoint related issues troubleshooting Docs that belong in the Troubleshooting section v8.7.0 labels Jan 10, 2023
@roxana-gheorghe
Copy link

One small note: self-healing is available for Platinum and Enterprise subscription level.

@joepeeples
Copy link
Contributor

Endpoint may also use the Volume Snapshot Service as a part of Elastic's effort to ensure the feature works properly even when it isn't in enforcement mode. Users can explicitly opt out of that by setting the windows.advanced.diagnostic.rollback_telemetry_enabled option to false.

@ferullo Could you explain a bit more what "isn't in enforcement mode" means here? Is it just when the rollback feature is disabled (windows.advanced.alerts.rollback.self_healing.enabled is false or blank), or is there another setting specifically for "enforcement mode"? Thanks!

@ferullo
Copy link
Collaborator Author

ferullo commented Jan 18, 2023

Yeah I meant disabled, I should have just said that 😄

@joepeeples joepeeples added Priority: Medium Issues that have relevance, but aren't urgent Effort: Medium Issues that take moderate but not substantial time to complete labels Jun 23, 2023
@111andre111
Copy link

111andre111 commented Sep 22, 2023

Just to mention that documenting as well that Volume Snapshot Service technique is used for this sounds like a good idea.

Would be good to get some drive on that one. Thanks a lot.

If from this issue the resulting docs page would be another one, linking these together with:
https://www.elastic.co/guide/en/security/8.9/self-healing-rollback.html

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Effort: Medium Issues that take moderate but not substantial time to complete Priority: Medium Issues that have relevance, but aren't urgent Team: Endpoint Endpoint related issues troubleshooting Docs that belong in the Troubleshooting section v8.7.0
Projects
None yet
Development

Successfully merging a pull request may close this issue.

5 participants