Elastic Defender as Antivirus

[0xVavaldi]

Problem

Antivirus Coverage currently does not detect Elastic Defend Agents as antivirus protection.

Proposed Solution

Add support for Elastic Defend antivirus

Alternatives Considered

No response

Component

Web Dashboard

Scope

None

[ToddHebebrand]

Acknowledged. AV-coverage detection doesn't currently recognize Elastic Defend agents, so devices protected by it show as unprotected. The fix is adding Elastic Defend to the AV product detection set. Keeping open and tracking — thanks.

[ToddHebebrand]

Shipped in v0.88.0. PR #2068 adds Elastic Defend to the antivirus detection set, so devices protected by it now report AV coverage instead of showing unprotected.

Once you're on v0.88.0+, please confirm your Elastic Defend endpoints show as protected — leaving this open until you've verified.

[0xVavaldi]

Not functional yet since I am running on Linux, the proposed change only covers windows I believe.

[ToddHebebrand]

Confirmed — the v0.88.0 fix only covered platforms where an AV provider gets enumerated, and Linux wasn't one of them. On Linux the agent never collected any AV info at all (there's no security-center registry to read), so Elastic Defend hosts fell through to "unprotected" regardless of the provider mapping #2068 added.

PR #2306 addresses this: the Linux agent now probes the Elastic Defend sensor directly — the /opt/Elastic/Endpoint/elastic-endpoint binary, the elastic-endpoint process, and the ElasticEndpoint.service unit — and reports it as antivirus coverage with real-time protection when the sensor is running. Note it keys on the Endpoint sensor specifically, not the Elastic Agent shipper, so only hosts actually running the Defend integration count as protected.

Will follow up here once it ships so you can verify on your Linux endpoints.

[ToddHebebrand]

Reopening until you can verify on your Linux endpoints — the merge auto-closed this. The fix (#2306) is on main and will be in the next release; once your Elastic Defend hosts show AV coverage, feel free to close.