Correct issue with Defender being turned off

[tylmorr-snl]

Defender is turned off by default when installing elastic agent. This may not be the desired outcome and a fix is being worked to stop this from occuring by default.

[ntrnflxlbs]

Yeah, well, apparently, the elastic defender agent fights with existing deployed AVs and entirely kills system performance, eating up CPU and RAM. perhaps make sure that's the right move.

[aarz-snl]

Yeah, well, apparently, the elastic defender agent fights with existing deployed AVs and entirely kills system performance, eating up CPU and RAM. perhaps make sure that's the right move.

The "Right move" it completely dependent on the user and what the user wants.

This isn't so much a bug and more a preference -- however, considering most people use Windows Defender it should be off by default and turned on if wanted.

It isn't 'stuck' like that though. This is easily fixed utilizing available documentation from elastic:

https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html

Check the box in the elastic defend integration to turn off malware protection resolves it. Also turn off registry as an antivirus a little further down

[aarz-snl]

Another issue here is users probably want this on for NON windows defender endpoints -- (ie. linux) we need to think about developing a linux policy and windows policy separately. Short term i think off by default with documentation on how to turn on and manage policies

[aarz-snl]

Ansible playbook needs to be adjusted to the following for Elastic Defend job:

          inputs:
            - enabled: true
              streams: []
              type: "endpoint"
              config:
                _config:
                  value:
                    type: "endpoint"
                    endpointConfig:
                      preset: "EDRComplete"
                policy:
                  value:
                    windows:
                      malware:
                        mode: "off"
                        blocklist: false
                        on_write_scan: false
                      antivirus_registration:
                        mode: "sync_with_malware_prevent"
                        enabled: false
                    mac:
                      malware:
                        mode: "off"
                        blocklist: false
                        on_write_scan: false
                    linux:
                      malware:
                        mode: "off"
                        blocklist: false
                        on_write_scan: false