# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=1 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 2 --- ## [Cannot create Exception for Rule "Persistence via Extensible Firmware Modification"](https://discuss.elastic.co/t/cannot-create-exception-for-rule-persistence-via-extensible-firmware-modification/386795)
**Author:** [@RalphDibney](https://discuss.elastic.co/u/RalphDibney)\ **Replies:** 2\ **Last updated:** [June 15, 2026, 1:35pm UTC](https://discuss.elastic.co/t/cannot-create-exception-for-rule-persistence-via-extensible-firmware-modification/386795 "2026-06-15T13:35:28Z")
The Defend Rule "Malicious Behavior Prevention Alert: Persistence via Extensible Firmware Modification" gets triggered in our environment. The behavior is explainable and unproblematic, so we wanted to create an endpoint… --- ## [Feedback on the Security Solution Dashboard Experience](https://discuss.elastic.co/t/feedback-on-the-security-solution-dashboard-experience/386721)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 6\ **Last updated:** [June 15, 2026, 8:25am UTC](https://discuss.elastic.co/t/feedback-on-the-security-solution-dashboard-experience/386721 "2026-06-15T08:25:50Z")
Hello, I would like to share some feedback regarding the Security Solution dashboard experience in Kibana. While I appreciate the effort to provide a dedicated Security-focused dashboard experience, many users in our en… --- ## [False Positive Report — 4K\_Render\_Automation.exe — Malicious (high Confidence)](https://discuss.elastic.co/t/false-positive-report-4k-render-automation-exe-malicious-high-confidence/386586)
**Author:** [@Qu\_c\_Chau](https://discuss.elastic.co/u/Qu_c_Chau)\ **Replies:** 4\ **Last updated:** [June 4, 2026, 2:23pm UTC](https://discuss.elastic.co/t/false-positive-report-4k-render-automation-exe-malicious-high-confidence/386586 "2026-06-04T14:23:14Z")
Reporting a false positive for Elastic's malware detection engine. File: 4K\_Render\_Automation.exe SHA256: 8e8ab81e34a69221ff50b5b94f033cc31969cc39214efd0346f06a48957b991f Detection: Malicious (high Confidence) VT lin… --- ## [High CPU Usage on Elastic Defend and Kibana Processes](https://discuss.elastic.co/t/high-cpu-usage-on-elastic-defend-and-kibana-processes/386663)
**Author:** [@YousefNein](https://discuss.elastic.co/u/YousefNein)\ **Replies:** 0\ **Last updated:** [June 2, 2026, 11:35pm UTC](https://discuss.elastic.co/t/high-cpu-usage-on-elastic-defend-and-kibana-processes/386663 "2026-06-02T23:35:40Z")
Hello, I have two problems related to CPU usage being very high with two ES related processes. I'm currently using 3 ES nodes on the same machine using Docker. 1 Master hot/content, 1 warm, and 1 cold. The machine has … --- ## [Feature Request: Native named pipe events in Elastic Defend (SMB beacon detection)](https://discuss.elastic.co/t/feature-request-native-named-pipe-events-in-elastic-defend-smb-beacon-detection/386595)
**Author:** [@labrend](https://discuss.elastic.co/u/labrend)\ **Replies:** 0\ **Last updated:** [May 31, 2026, 8:56pm UTC](https://discuss.elastic.co/t/feature-request-native-named-pipe-events-in-elastic-defend-smb-beacon-detection/386595 "2026-05-31T20:56:06Z")
Hi everyone, I've just submitted a feature request on GitHub to add native named pipe event collection to Elastic Defend: \[Elastic Defend\] Add native named pipe event collection (Sysmon EID 17/18 equivalent) · Issue #2… --- ## [Firewall Detection Rules](https://discuss.elastic.co/t/firewall-detection-rules/386399)
**Author:** [@jatin3101](https://discuss.elastic.co/u/jatin3101)\ **Replies:** 6\ **Last updated:** [May 26, 2026, 7:58pm UTC](https://discuss.elastic.co/t/firewall-detection-rules/386399 "2026-05-26T19:58:29Z")
I have a use case where i need to collect logs from firewall ( checkpoint ) so ,i did that but now the thing is i want to enable detection rules(as we are running dummy attacks ) for firewall (like we can do wo for windo… --- ## [Using LLM together Elastic SIEM](https://discuss.elastic.co/t/using-llm-together-elastic-siem/386464)
**Author:** [@arcsons](https://discuss.elastic.co/u/arcsons)\ **Replies:** 0\ **Last updated:** [May 24, 2026, 7:25am UTC](https://discuss.elastic.co/t/using-llm-together-elastic-siem/386464 "2026-05-24T07:25:46Z")
Hi all I have configured a local Mistral LLM with my Elastic Stack (version 9.3.3). I also have the full Enterprise license enabled. From a security perspective, I’m curious how others are using LLMs within Elastic. Ha… --- ## [No response from Sales for Student License (Self-Managed )](https://discuss.elastic.co/t/no-response-from-sales-for-student-license-self-managed/386366)
**Author:** [@Borhen\_Alaya](https://discuss.elastic.co/u/Borhen_Alaya)\ **Replies:** 5\ **Last updated:** [May 19, 2026, 1:50am UTC](https://discuss.elastic.co/t/no-response-from-sales-for-student-license-self-managed/386366 "2026-05-19T01:50:12Z")
Hi everyone, I am a final-year student, working on my graduation project (Threat Detection with Elastic Security on local VMs). I need to test Email Connectors for detection rules (Platinum feature). I contacted Suppor… --- ## [Request for Elastic Security Free Trial Extension for SOC PoC Internship Project](https://discuss.elastic.co/t/request-for-elastic-security-free-trial-extension-for-soc-poc-internship-project/386259)
**Author:** [@Nabyl\_Ouchine](https://discuss.elastic.co/u/Nabyl_Ouchine)\ **Replies:** 5\ **Last updated:** [May 12, 2026, 4:35pm UTC](https://discuss.elastic.co/t/request-for-elastic-security-free-trial-extension-for-soc-poc-internship-project/386259 "2026-05-12T16:35:00Z")
Hello Elastic Security Team, I hope you are doing well. I would like to kindly follow up regarding my requests for an extension of the Elastic Security free trial. I have submitted multiple requests but unfortunately I… --- ## [Define proxy for AI connector](https://discuss.elastic.co/t/define-proxy-for-ai-connector/386278)
**Author:** [@hairless\_mess](https://discuss.elastic.co/u/hairless_mess)\ **Replies:** 1\ **Last updated:** [May 11, 2026, 1:44pm UTC](https://discuss.elastic.co/t/define-proxy-for-ai-connector/386278 "2026-05-11T13:44:05Z")
Hi everyone! I'm trying to add an AI connector and I'm running into a connection problem because the connector can't reach the AI solution as it needs to pass through our proxy. Is there a way to add a proxy configuratio… --- ## [Problems Correlating Data with Rules Created for Detecting Access to Forbidden Websites](https://discuss.elastic.co/t/problems-correlating-data-with-rules-created-for-detecting-access-to-forbidden-websites/386197)
**Author:** [@Matheusreis12](https://discuss.elastic.co/u/Matheusreis12)\ **Replies:** 0\ **Last updated:** [May 6, 2026, 7:57pm UTC](https://discuss.elastic.co/t/problems-correlating-data-with-rules-created-for-detecting-access-to-forbidden-websites/386197 "2026-05-06T19:57:29Z")
Hello friends Good morning I hope you are all well. I recently encountered a question regarding a client's request involving the creation of a rule to detect access to certain IP addresses. The client has some rules … --- ## [Some prebuilt security rules have missing fields](https://discuss.elastic.co/t/some-prebuilt-security-rules-have-missing-fields/386132)
**Author:** [@YousefNein](https://discuss.elastic.co/u/YousefNein)\ **Replies:** 1\ **Last updated:** [May 3, 2026, 1:54pm UTC](https://discuss.elastic.co/t/some-prebuilt-security-rules-have-missing-fields/386132 "2026-05-03T13:54:18Z")
As the title suggests, some prebuilt security rules are failing due to some fields not being present in the Elastic Defend telemetry. From this example, the rule logic has process.command\_line , However, the file teleme… --- ## [False Positive Report - itzOpti.exe - Elastic](https://discuss.elastic.co/t/false-positive-report-itzopti-exe-elastic/385949)
**Author:** [@Luca1](https://discuss.elastic.co/u/Luca1)\ **Replies:** 1\ **Last updated:** [April 29, 2026, 9:40pm UTC](https://discuss.elastic.co/t/false-positive-report-itzopti-exe-elastic/385949 "2026-04-29T21:40:26Z")
Hello, I am reporting a false positive detection for my file. Vendor: Elastic Detection name: Malicious (high Confidence) SHA256: 6ed1f7c0565b84201b7f9b7ed47eee7f73fddad453ae9e4ce7914369b9ad1311 VirusTotal: VirusTot… --- ## [False Positive Report – EXO Panda Installer (Elastic Detection)](https://discuss.elastic.co/t/false-positive-report-exo-panda-installer-elastic-detection/386082)
**Author:** [@Jude\_Tallent](https://discuss.elastic.co/u/Jude_Tallent)\ **Replies:** 1\ **Last updated:** [April 29, 2026, 9:29pm UTC](https://discuss.elastic.co/t/false-positive-report-exo-panda-installer-elastic-detection/386082 "2026-04-29T21:29:52Z")
Hello Elastic Team, I'm the owner of EXO Panda (exopanda.com), a legitimate macro and tutorial hub for Roblox players. I'm reaching out regarding a false positive detection by Elastic's engine on VirusTotal for our inst… --- ## [Elastic Security is missing in kibana \[9.0.2\]](https://discuss.elastic.co/t/elastic-security-is-missing-in-kibana-9-0-2/379228)
**Author:** [@Anacleto\_Barzetti](https://discuss.elastic.co/u/Anacleto_Barzetti)\ **Replies:** 5\ **Last updated:** [April 28, 2026, 2:14pm UTC](https://discuss.elastic.co/t/elastic-security-is-missing-in-kibana-9-0-2/379228 "2026-04-28T14:14:37Z")
Elastic Security is not showing up, I installed via docker compose. kibana.yml server.host: "0.0.0.0" telemetry.enabled: "false" xpack.fleet.packages: - name: fleet\_server version: latest - name: system … --- ## [Cofense Intelligence (ti integration)](https://discuss.elastic.co/t/cofense-intelligence-ti-integration/386065)
**Author:** [@walburton](https://discuss.elastic.co/u/walburton)\ **Replies:** 0\ **Last updated:** [April 27, 2026, 9:39pm UTC](https://discuss.elastic.co/t/cofense-intelligence-ti-integration/386065 "2026-04-27T21:39:25Z")
Creating this thread to request support for the Cofense Intelligence v2 (ThreatHQ) API which would provide the ability to natively pull Threat Intel from the Cofense feed into the Elastic TI product. This currently is no… --- ## [The response action does not work](https://discuss.elastic.co/t/the-response-action-does-not-work/385980)
**Author:** [@PatreKerier](https://discuss.elastic.co/u/PatreKerier)\ **Replies:** 8\ **Last updated:** [April 24, 2026, 9:19am UTC](https://discuss.elastic.co/t/the-response-action-does-not-work/385980 "2026-04-24T09:19:13Z")
Good afternoon! Tell me, please. I have created a custom rule defining the creation of a local user account, configured it so that the isolation of the host is performed using a "response action", but nothing happens. … --- ## [Can you track Windows Defender sample submission?](https://discuss.elastic.co/t/can-you-track-windows-defender-sample-submission/385705)
**Author:** [@Florian\_Heigl](https://discuss.elastic.co/u/Florian_Heigl)\ **Replies:** 4\ **Last updated:** [April 23, 2026, 12:29am UTC](https://discuss.elastic.co/t/can-you-track-windows-defender-sample-submission/385705 "2026-04-23T00:29:18Z")
I just had a popup from Windows Defender, it wanted confirmation for uploading a sample (some browser temp file). Elastic Agent+Defend is also running, the primary tool is still Windows Defender. In my Elastic Dashboard… --- ## [\_DataId Health Monitoring](https://discuss.elastic.co/t/dataid-health-monitoring/385914)
**Author:** [@saratsekhar](https://discuss.elastic.co/u/saratsekhar)\ **Replies:** 12\ **Last updated:** [April 22, 2026, 6:45am UTC](https://discuss.elastic.co/t/dataid-health-monitoring/385914 "2026-04-22T06:45:46Z")
Looking to build a logic which alerts whenever there is a log stoppage detected on Elastic through \_dataId. I appreciate any suggestions here. --- ## [Refer to value lists in ES|QL?](https://discuss.elastic.co/t/refer-to-value-lists-in-es-ql/384135)
**Author:** [@alyx](https://discuss.elastic.co/u/alyx)\ **Replies:** 1\ **Last updated:** [April 17, 2026, 6:37pm UTC](https://discuss.elastic.co/t/refer-to-value-lists-in-es-ql/384135 "2026-04-17T18:37:21Z")
Hi everyone! Trying to migrate from other SIEM platforms. One question is, is it possible to define some lists and refer to them across different rules? Like WHERE source.ip IN ${some\_defined\_list}? I tried to use valu… --- ## [Elastic Defend - Enterprise Subscription (Replace Client AntiVirus)](https://discuss.elastic.co/t/elastic-defend-enterprise-subscription-replace-client-antivirus/385915)
**Author:** [@GreysMatter](https://discuss.elastic.co/u/GreysMatter)\ **Replies:** 2\ **Last updated:** [April 17, 2026, 2:14pm UTC](https://discuss.elastic.co/t/elastic-defend-enterprise-subscription-replace-client-antivirus/385915 "2026-04-17T14:14:24Z")
Hi Guys, Looking for some advice. I currently have a Serverless Elastic Security Enterprise subscription and have the agent running on all my clients. My ES profiles are configured to "Detect only". I also use Eset P… --- ## [Indicator Match rule not generating alerts (Basic license, self-managed 9.3.0)](https://discuss.elastic.co/t/indicator-match-rule-not-generating-alerts-basic-license-self-managed-9-3-0/385726)
**Author:** [@arav](https://discuss.elastic.co/u/arav)\ **Replies:** 1\ **Last updated:** [April 16, 2026, 7:27pm UTC](https://discuss.elastic.co/t/indicator-match-rule-not-generating-alerts-basic-license-self-managed-9-3-0/385726 "2026-04-16T19:27:09Z")
Hi all, I am running a self-managed Elastic Stack (v9.3.0) with a Basic license. I have ingested threat intelligence data from MISP using the official integration, and I am trying to create an Indicator Match rule in E… --- ## [Error after creating Detection rules in Elastic Security; Not getting alerts](https://discuss.elastic.co/t/error-after-creating-detection-rules-in-elastic-security-not-getting-alerts/385908)
**Author:** [@wicklanm](https://discuss.elastic.co/u/wicklanm)\ **Replies:** 3\ **Last updated:** [April 16, 2026, 7:05pm UTC](https://discuss.elastic.co/t/error-after-creating-detection-rules-in-elastic-security-not-getting-alerts/385908 "2026-04-16T19:05:02Z")
Hey everyone, After I added Security Detection Rules in my Elastic Search, I get the following error below. what does this mean and what can I do to fix it? I am not getting any alerts from this. This is for my Windows … --- ## [Using Elastic Security as SOAR for IBM QRadar SIEM (Log Forwarding Architecture)](https://discuss.elastic.co/t/using-elastic-security-as-soar-for-ibm-qradar-siem-log-forwarding-architecture/385893)
**Author:** [@PatreKerier](https://discuss.elastic.co/u/PatreKerier)\ **Replies:** 5\ **Last updated:** [April 16, 2026, 1:41pm UTC](https://discuss.elastic.co/t/using-elastic-security-as-soar-for-ibm-qradar-siem-log-forwarding-architecture/385893 "2026-04-16T13:41:59Z")
Hi everyone, I'm working on a project to integrate IBM QRadar SIEM with Elastic Security. The goal is to use Elastic specifically for its SOAR capabilities (Case Management, Automation, Response Actions) while keeping Q… --- ## [UX improvements (Security app)](https://discuss.elastic.co/t/ux-improvements-security-app/385898)
**Author:** [@proclick](https://discuss.elastic.co/u/proclick)\ **Replies:** 1\ **Last updated:** [April 16, 2026, 2:58am UTC](https://discuss.elastic.co/t/ux-improvements-security-app/385898 "2026-04-16T02:58:50Z")
Hey Team, are there planned any updates regarding security alerts managing? Will it be possible to add a Note as a bulk action for the few similar cases as it is possible to change alerts' status and closure reason now… --- ## [Sensor endgame WebSocket validation](https://discuss.elastic.co/t/sensor-endgame-websocket-validation/385836)
**Author:** [@Omar\_Tawfik\_kandil](https://discuss.elastic.co/u/Omar_Tawfik_kandil)\ **Replies:** 0\ **Last updated:** [April 9, 2026, 11:39pm UTC](https://discuss.elastic.co/t/sensor-endgame-websocket-validation/385836 "2026-04-09T23:39:35Z")
Hi all, I’m troubleshooting an Elastic Endgame / SMP issue and wanted to check whether anyone has seen this before. Environment: SMP Platform 3.52.3 Generated Windows sensor version 3.65.2 Windows 10 fresh VM … --- ## [Workflows' Connectors in DaC](https://discuss.elastic.co/t/workflows-connectors-in-dac/385829)
**Author:** [@proclick](https://discuss.elastic.co/u/proclick)\ **Replies:** 0\ **Last updated:** [April 9, 2026, 5:43pm UTC](https://discuss.elastic.co/t/workflows-connectors-in-dac/385829 "2026-04-09T17:43:51Z")
Hello Team, I’ve been using DaC for a while in my infrastructure and pretty satisfied with it as a source of truth and version control. I’ve recently created few custom Workflows and wanted to attach them to the securi… --- ## [System requirements for Elastic Security "All-in-One" pilot deployment](https://discuss.elastic.co/t/system-requirements-for-elastic-security-all-in-one-pilot-deployment/385731)
**Author:** [@PatreKerier](https://discuss.elastic.co/u/PatreKerier)\ **Replies:** 3\ **Last updated:** [April 3, 2026, 8:30am UTC](https://discuss.elastic.co/t/system-requirements-for-elastic-security-all-in-one-pilot-deployment/385731 "2026-04-03T08:30:42Z")
Hello everyone, My company is planning a pilot project to test Elastic Security (including Elasticsearch, Kibana, Logstash, and Fleet). We are also looking into integrating it with various third-party services. For thi… --- ## [Entra ID Unusual Cloud Device Registration](https://discuss.elastic.co/t/entra-id-unusual-cloud-device-registration/385717)
**Author:** [@lonpm2](https://discuss.elastic.co/u/lonpm2)\ **Replies:** 2\ **Last updated:** [April 1, 2026, 8:05am UTC](https://discuss.elastic.co/t/entra-id-unusual-cloud-device-registration/385717 "2026-04-01T08:05:38Z")
Receiving a number of these alerts after a recent update to alerts, in vestigating I find that the following string is being located: User-Agent Microsoft.OData.Client/7.12.5. However investigation of all such alerts do… --- ## [Guidance for running Elastic Defend on ECE hosts](https://discuss.elastic.co/t/guidance-for-running-elastic-defend-on-ece-hosts/385617)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 0\ **Last updated:** [March 25, 2026, 8:48pm UTC](https://discuss.elastic.co/t/guidance-for-running-elastic-defend-on-ece-hosts/385617 "2026-03-25T20:48:11Z")
Hello, Is it supported to run Elastic Agent with the Defend integration (ofc first in detect mode initially) on ECE hosts? Should we configure Trusted Applications? If so, which ones? Best regards, Willem [Previous page](https://discuss.elastic.co/c/security/83.md) [Next page](https://discuss.elastic.co/c/security/83.md?page=2)