Skip to main content

Troubleshooting

Common *Beat Deployment Issues​

  • Beat .yml config needs to have consistent indentation (YAML is very strict), otherwise the Beat will fail to start
  • Beat .yml config needs to have SSL enabled when sending data to the DIP Logstash: 
    output.logstash:
        ssl.enabled: true
  • Beat .yml config needs to be pointing at the DIP firewall external IP when sending data to the DIP Logstash: 
    output.logstash:
        hosts: "<DIP_EXTERNAL_IP>"

    NOTE: The Beat will install "successfully" with incorrect output.logstash settings, but will fail to send data to the DIP Logstash.

Winlogbeat failing to install due to a bad config:

Common Sysmon Deployment Issues​

  • The deployed Sysmon version needs to be able to support the provided sysmonconfig.xml file - older versions of Sysmon may fail to start when attempting to load newer configs, depending on the settings employed

    NOTE: This issue is relavent to situations where Sysmon is already installed in the environment, but the CPT is providing their own configuration

  • Windows systems with outdated Root CAs installed will not trust Sysmon's driver certificate, preventing successful installation

Sysmon failing to install due to a bad config:

Common Endgame Deployment Issues​

  • The Endgame sensor transceiver address needs to be set to the DIP firewall external IP https://<DIP_EXTERNAL_IP>:443
  • Windows systems with outdated Root CAs installed will not trust Endgame's driver certificate, preventing successful installation