Console shows Remediation Component that does not exist in Security Engine

1

I have a central LAPI, and after install of a Security Engine and firewall bouncer on a remote node, which created a bouncer on the local Security Engine, I pointed both at the central LAPI, and removed the bouncer from the local SE instance, however the cloud Console still shows 1 Remediation Component attached to the SE, and complains that it’s been offline for days.

For the node in question:

screenshot-20241109-074003
screenshot-20241109-0740031451×251 26.3 KB

$ cscli bouncers list                   
──────────────────────────────────────────────────────────────────
 Name  IP Address  Valid  Last API pull  Type  Version  Auth Type 
──────────────────────────────────────────────────────────────────
──────────────────────────────────────────────────────────────────

Bug with the console, or am I doing something wrong here?

2

can you run cscli capi status and check the username from the output matches the identifier shown in the console if you click on engine name.

3

Yes usernames/IDs match, and I should note that I have multiple engines configured in the same way (engine/bouncer connected to central LAPI) that exhibit the same behaviour in the console (ghost remediation component).

4

Yes but the only machine that should be enrolled in the console is the central LAPI, as the others are not communicating via their own LAPI anymore so they will never contact CAPI again.

5

You’re suggesting that the only node that should be joined to the CAPI is the LAPI node?

Are we not supposed to be able to review e.g. scenarios that are configured on each engine from the console? Or confirm that the other engines are online from the console? That seems a strange limitation, and I can see that these engines are updating the Last Activity stat regularly.