elastic / elastic/integrations

[DGA]: backend closed connection when Kibana memory size too small

Open
#18,550 3 comments 0 reactions 0 assignees View on GitHub
Integration:dga Team:Security-Applied ML
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
2d 17h
Merged PRs (30d)
225

Description

### Integration Name

Domain Generation Algorithm Detection [dga]

### Dataset Name

_No response_

### Integration Version

2.3.7

### Agent Version

n/a

### Agent Output Type

elasticsearch

### Elasticsearch Version

9.3.3

### OS Version and Architecture

ECH

### Software/API Version

_No response_

### Error Message

`backend closed connection`

### Event Original

_No response_

### What did you do?

On 1 GB Kibana memory size on ECH

```
POST kbn:/api/fleet/epm/packages/dga/2.3.7
{
"force": true
}

# fails
```

Same with installing via
- Integrations page > Add DGA
- Integrations page > Install DGA assets

After increasing Kibana memory size to 2 GB, the installation succeeds

### What did you see?

Kibana 1 GB memory - fails

Image

### What did you expect to see?

Kibana 2 GB memory - success

Image

### Anything else?

This is a known issue, but previously not thought to affect the model on ECH. It's only through testing on the smallest memory size this happens.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.