Fleet may lose connection to a SIEM after Fabric Servers restart in quick succession

Fleet may lose communication with a Fabric-enabled Guardsix SIEM instance when the SIEM reconnects to Fabric several times in a short period. For example, this can happen during maintenance when you restart the Fabric servers in a cluster deployment one after another.

Each time a SIEM instance reconnects to Fabric, it may receive a new connection address. When this happens several times in quick succession, Fleet may keep an outdated address for the SIEM instance. Fleet components then can't reach the SIEM instance until the address is corrected.

If your deployment is affected by this issue, you may see the following signs:

• You can’t access the affected SIEM instance through Fleet Management Shell.
• Requests to the Fleet Search API for the affected SIEM instance fail.
• Searches, dashboards, or incidents for the affected SIEM instance don't load in Federated investigations.

1. Upgrade to Fleet v2.12.1.
2. If you can’t upgrade yet and are affected, contact Guardsix Support to restore communication with the SIEM.