# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=10 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 11 --- ## [Missing "Custom Fields" in alerts generated from "endpoint" indexes](https://discuss.elastic.co/t/missing-custom-fields-in-alerts-generated-from-endpoint-indexes/369436)
**Author:** [@aptfinf](https://discuss.elastic.co/u/aptfinf)\ **Replies:** 4\ **Last updated:** [October 29, 2024, 2:55pm UTC](https://discuss.elastic.co/t/missing-custom-fields-in-alerts-generated-from-endpoint-indexes/369436 "2024-10-29T14:55:22Z")
Hello, I would like to ask a question about Custom Fields. I had just added a "Custom Field" inside one of my Fleet Policy, as shown on the below screenshot: I get the field correctly added to all the logs (and ther… --- ## [Cannot view alerted log in security alert](https://discuss.elastic.co/t/cannot-view-alerted-log-in-security-alert/368594)
**Author:** [@Tee55](https://discuss.elastic.co/u/Tee55)\ **Replies:** 4\ **Last updated:** [October 22, 2024, 10:23pm UTC](https://discuss.elastic.co/t/cannot-view-alerted-log-in-security-alert/368594 "2024-10-22T22:23:00Z")
I tried to create a custom detection rule for MITRE ATT&CK T1078 using the json logs as shown in image below: I upload my log file using " Upload data from a file" integration. Then, I tried to create simple rule us… --- ## [What does the "user: 7 (Authentication failure)" mean?](https://discuss.elastic.co/t/what-does-the-user-7-authentication-failure-mean/369242)
**Author:** [@just4bs](https://discuss.elastic.co/u/just4bs)\ **Replies:** 0\ **Last updated:** [October 22, 2024, 5:15pm UTC](https://discuss.elastic.co/t/what-does-the-user-7-authentication-failure-mean/369242 "2024-10-22T17:15:27Z")
Came across this in an alert. What does the 7 mean here? Is there a list of codes that include other numbers? Thanks --- ## [How to reopen an accidental closing of all alerts](https://discuss.elastic.co/t/how-to-reopen-an-accidental-closing-of-all-alerts/369082)
**Author:** [@just4bs](https://discuss.elastic.co/u/just4bs)\ **Replies:** 3\ **Last updated:** [October 22, 2024, 3:09pm UTC](https://discuss.elastic.co/t/how-to-reopen-an-accidental-closing-of-all-alerts/369082 "2024-10-22T15:09:49Z")
I was working on an alert and ended up closing all of the alerts on the server. Is there a way to reopen the ones I closed at a certain time? I assume I need to be able to see when I did it first. Thanks in advance. --- ## [Detection Rules Update Failure](https://discuss.elastic.co/t/detection-rules-update-failure/369051)
**Author:** [@syk](https://discuss.elastic.co/u/syk)\ **Replies:** 8\ **Last updated:** [October 22, 2024, 1:42pm UTC](https://discuss.elastic.co/t/detection-rules-update-failure/369051 "2024-10-22T13:42:05Z")
Hi, With version 8.15.3 we see 18 prebuilt security detection rules failing to update (Screenshot): List of rules not being able to update: Anomalous Windows Process Creation Suspicious Windows Process Cluster Spawn… --- ## [Issue monitoring registry key using elastic agent (File Integrity Monitoring integration)](https://discuss.elastic.co/t/issue-monitoring-registry-key-using-elastic-agent-file-integrity-monitoring-integration/369086)
**Author:** [@ganrt](https://discuss.elastic.co/u/ganrt)\ **Replies:** 1\ **Last updated:** [October 18, 2024, 10:16pm UTC](https://discuss.elastic.co/t/issue-monitoring-registry-key-using-elastic-agent-file-integrity-monitoring-integration/369086 "2024-10-18T22:16:36Z")
Hello. Recently a deploy elastic stack with elastic agent and it seem to be no monitoring registry key, however if I place a folder directory it works file, however not with registry key path, any suggestion what to mo… --- ## [Integration Elasitc stack with thehive](https://discuss.elastic.co/t/integration-elasitc-stack-with-thehive/368898)
**Author:** [@adilraad2001](https://discuss.elastic.co/u/adilraad2001)\ **Replies:** 2\ **Last updated:** [October 17, 2024, 8:41am UTC](https://discuss.elastic.co/t/integration-elasitc-stack-with-thehive/368898 "2024-10-17T08:41:08Z")
Hello guys i try to integrate elastic security with thehive using webhook in kibana connectors and action to do the next: when elastic security generate alert send the alert automaticly to thehive but the problem i h… --- ## [Detection Rules Integration Dependencies](https://discuss.elastic.co/t/detection-rules-integration-dependencies/368822)
**Author:** [@syk](https://discuss.elastic.co/u/syk)\ **Replies:** 4\ **Last updated:** [October 16, 2024, 12:49pm UTC](https://discuss.elastic.co/t/detection-rules-integration-dependencies/368822 "2024-10-16T12:49:37Z")
Hi, We experience some issues with detection rules detecting their dependencies on installed integrations correctly: a) Installed Integrations are displayed as "Disabled" complaining there would be no agent policies us… --- ## [Distinguish between actions in container from action on hosts](https://discuss.elastic.co/t/distinguish-between-actions-in-container-from-action-on-hosts/368828)
**Author:** [@patomtom](https://discuss.elastic.co/u/patomtom)\ **Replies:** 0\ **Last updated:** [October 15, 2024, 9:02am UTC](https://discuss.elastic.co/t/distinguish-between-actions-in-container-from-action-on-hosts/368828 "2024-10-15T09:02:08Z")
Hello, I wonder, if there's possibility for elastic-agent to distinguish between actions in docker/containers/k8s and actions occuring directly on host. The issue is there are bunch of FP alerts, which are related to c… --- ## [Generative AI asstiant](https://discuss.elastic.co/t/generative-ai-asstiant/368507)
**Author:** [@arcsons](https://discuss.elastic.co/u/arcsons)\ **Replies:** 2\ **Last updated:** [October 9, 2024, 1:40pm UTC](https://discuss.elastic.co/t/generative-ai-asstiant/368507 "2024-10-09T13:40:07Z")
Hi, I'm planning to test the AI Assistant in my lab, where I'm running Elastic Security with a trial license. I have two basic questions about it: The documentation states: "You need an account with a third-party gen… --- ## [Cannot Integrate FortiEDR Logs in Elastic SIEM](https://discuss.elastic.co/t/cannot-integrate-fortiedr-logs-in-elastic-siem/368157)
**Author:** [@threathunter](https://discuss.elastic.co/u/threathunter)\ **Replies:** 5\ **Last updated:** [October 3, 2024, 1:34pm UTC](https://discuss.elastic.co/t/cannot-integrate-fortiedr-logs-in-elastic-siem/368157 "2024-10-03T13:34:03Z")
Hi Elastic Team and Community I'm a beginner with Elastic and I'm trying to add the "Fortinet FortiEDR Logs" integration to our Elastic setup. we signed up a Free Trial in your Elastic SIEM Cloud and tried to integrate… --- ## [Clarification on Rules execution](https://discuss.elastic.co/t/clarification-on-rules-execution/368073)
**Author:** [@abubacker](https://discuss.elastic.co/u/abubacker)\ **Replies:** 1\ **Last updated:** [October 3, 2024, 10:26am UTC](https://discuss.elastic.co/t/clarification-on-rules-execution/368073 "2024-10-03T10:26:28Z")
I need clarification on the following scenario regarding Elastic: We have three spaces configured: In Space 1, a rule was enabled by a user with admin privileges. In Space 2, a rule was enabled by a custom user who on… --- ## [What does field field false positive examples do (how to use it) in an Elastic alert rule?](https://discuss.elastic.co/t/what-does-field-field-false-positive-examples-do-how-to-use-it-in-an-elastic-alert-rule/368129)
**Author:** [@Peter\_K](https://discuss.elastic.co/u/Peter_K)\ **Replies:** 1\ **Last updated:** [October 2, 2024, 1:45pm UTC](https://discuss.elastic.co/t/what-does-field-field-false-positive-examples-do-how-to-use-it-in-an-elastic-alert-rule/368129 "2024-10-02T13:45:21Z")
In an Elastic alert rule (Security | rules) under about | advanced settings, there is a field False positive examples I've tested with 2 IP address and triggered a virus (eicar) detection rule with one of these IP adress… --- ## [I can't add or edit Shared Exception List](https://discuss.elastic.co/t/i-cant-add-or-edit-shared-exception-list/367063)
**Author:** [@Matheus\_Marques](https://discuss.elastic.co/u/Matheus_Marques)\ **Replies:** 1\ **Last updated:** [October 2, 2024, 11:19am UTC](https://discuss.elastic.co/t/i-cant-add-or-edit-shared-exception-list/367063 "2024-10-02T11:19:58Z")
I'm facing problem to edit my shared exception list... I'd like to edit my rules to add a new SHA256 hash for a new version of my .exe, but this field is locked. How to solve it? --- ## [Alarm for silent log source](https://discuss.elastic.co/t/alarm-for-silent-log-source/366879)
**Author:** [@KaWa](https://discuss.elastic.co/u/KaWa)\ **Replies:** 2\ **Last updated:** [October 2, 2024, 7:13am UTC](https://discuss.elastic.co/t/alarm-for-silent-log-source/366879 "2024-10-02T07:13:34Z")
Hi, I'd like to create an alarm for every log source that used to log frequently. How can I do this? Best regards Kai -- Version: 8.15.1 --- ## [Questions about Auditd Manager](https://discuss.elastic.co/t/questions-about-auditd-manager/368091)
**Author:** [@KungFuLastic](https://discuss.elastic.co/u/KungFuLastic)\ **Replies:** 2\ **Last updated:** [October 2, 2024, 5:57am UTC](https://discuss.elastic.co/t/questions-about-auditd-manager/368091 "2024-10-02T05:57:29Z")
Hi, a question on Auditd Manager Integration after reading the Overview: so it acts similarly to auditd service which reads and saves audit info from the kernel but instead of saving it to disk; it sends it to elastic. … --- ## [The suricata results shown on the \[filebeat dashboard\] are different from the results shown in the \[security -\> alerts\] on kibana](https://discuss.elastic.co/t/the-suricata-results-shown-on-the-filebeat-dashboard-are-different-from-the-results-shown-in-the-security-alerts-on-kibana/366226)
**Author:** [@lilyyy](https://discuss.elastic.co/u/lilyyy)\ **Replies:** 1\ **Last updated:** [October 1, 2024, 2:40pm UTC](https://discuss.elastic.co/t/the-suricata-results-shown-on-the-filebeat-dashboard-are-different-from-the-results-shown-in-the-security-alerts-on-kibana/366226 "2024-10-01T14:40:51Z")
I am using suricata module for the IDS and I am also activating suricata Integrations on SIEM. The filebeat suricata dashboard was created in kibana, and the suricata alert dashboard can also be checked in kibana(Securi… --- ## [How to import suricate.rules into SIEM deteciton rules?](https://discuss.elastic.co/t/how-to-import-suricate-rules-into-siem-deteciton-rules/367093)
**Author:** [@lilyyy](https://discuss.elastic.co/u/lilyyy)\ **Replies:** 1\ **Last updated:** [October 1, 2024, 1:51pm UTC](https://discuss.elastic.co/t/how-to-import-suricate-rules-into-siem-deteciton-rules/367093 "2024-10-01T13:51:49Z")
Hello. I'm using both filebeat suricata module and SIEM suricata agent on kibana. I realized that the results of detection alert are different between filbeat suricata module and SIEM suricata because they use differen… --- ## [How to directly integrate Elastic SaaS with Netskope SaaS](https://discuss.elastic.co/t/how-to-directly-integrate-elastic-saas-with-netskope-saas/368043)
**Author:** [@thiagosilva](https://discuss.elastic.co/u/thiagosilva)\ **Replies:** 4\ **Last updated:** [October 1, 2024, 1:45pm UTC](https://discuss.elastic.co/t/how-to-directly-integrate-elastic-saas-with-netskope-saas/368043 "2024-10-01T13:45:04Z")
I would like to know if anyone in the community has ever encountered the need to integrate Elastic SaaS with Netskope SaaS directly, from Cloud to Cloud, without depending on collectors or other external elements such as… --- ## [Best Way to Set Up Elastic Security for Threat Detection and Monitoring?](https://discuss.elastic.co/t/best-way-to-set-up-elastic-security-for-threat-detection-and-monitoring/368052)
**Author:** [@Chungsup\_Lim](https://discuss.elastic.co/u/Chungsup_Lim)\ **Replies:** 1\ **Last updated:** [October 1, 2024, 8:29am UTC](https://discuss.elastic.co/t/best-way-to-set-up-elastic-security-for-threat-detection-and-monitoring/368052 "2024-10-01T08:29:28Z")
Hi, I’m looking for advice on setting up Elastic Security for real-time threat detection and monitoring. Specifically, I’d like to know: What are the essential components needed for a solid infrastructure? Are there r… --- ## [Elastic-agent without sending logs no Elastic Security 8.15.1](https://discuss.elastic.co/t/elastic-agent-without-sending-logs-no-elastic-security-8-15-1/366972)
**Author:** [@wsouza](https://discuss.elastic.co/u/wsouza)\ **Replies:** 2\ **Last updated:** [October 1, 2024, 6:35am UTC](https://discuss.elastic.co/t/elastic-agent-without-sending-logs-no-elastic-security-8-15-1/366972 "2024-10-01T06:35:18Z")
Hi folks! Recently, I updated my cloud deployment for Elastic Security8.15.1 as the agents. In both environments, with this version, you may notice the following behavior: Elastic-agent has a healthy status but does not … --- ## [Carbon Black Cloud: CEL alert\_v7 400 bad request](https://discuss.elastic.co/t/carbon-black-cloud-cel-alert-v7-400-bad-request/366464)
**Author:** [@syk](https://discuss.elastic.co/u/syk)\ **Replies:** 5\ **Last updated:** [September 27, 2024, 7:50am UTC](https://discuss.elastic.co/t/carbon-black-cloud-cel-alert-v7-400-bad-request/366464 "2024-09-27T07:50:18Z")
The Integration Disclaimer reads, that the Alerts-API (v6) for this integration would be deactivated on July 31, 2024. We should transition to CEL input and the alert\_v7 data stream. So we did & the Agent holding the Int… --- ## [Elastic Security documentation](https://discuss.elastic.co/t/elastic-security-documentation/367162)
**Author:** [@arcsons](https://discuss.elastic.co/u/arcsons)\ **Replies:** 3\ **Last updated:** [September 26, 2024, 2:24pm UTC](https://discuss.elastic.co/t/elastic-security-documentation/367162 "2024-09-26T14:24:55Z")
Hi Does anyone know how I can print out the documentation Elastic Security Elastic Security Solution \[8.15\] | Elastic If possible it would be nice. Another question about the documentation, ist possible to buy the c… --- ## [Searching cases with custom fields](https://discuss.elastic.co/t/searching-cases-with-custom-fields/366393)
**Author:** [@Marek\_Galbavy](https://discuss.elastic.co/u/Marek_Galbavy)\ **Replies:** 2\ **Last updated:** [September 26, 2024, 6:46am UTC](https://discuss.elastic.co/t/searching-cases-with-custom-fields/366393 "2024-09-26T06:46:44Z")
Hi its possible search or filter cases in Kibana gui with custom fields? I create custom field with the name of the rule, add column to the table but i can filter or search with this field. --- ## [Linux and Windows events ingestion](https://discuss.elastic.co/t/linux-and-windows-events-ingestion/366940)
**Author:** [@Cristina\_Marletta\_Li](https://discuss.elastic.co/u/Cristina_Marletta_Li)\ **Replies:** 1\ **Last updated:** [September 23, 2024, 2:33pm UTC](https://discuss.elastic.co/t/linux-and-windows-events-ingestion/366940 "2024-09-23T14:33:03Z")
Hi, all. What is the best way to ingest linux and windows system events into Elasticsearch? We would like to use elasticsearch as siem. thanks. --- ## [Exceptions matches escaping](https://discuss.elastic.co/t/exceptions-matches-escaping/366374)
**Author:** [@j91321](https://discuss.elastic.co/u/j91321)\ **Replies:** 2\ **Last updated:** [September 23, 2024, 11:50am UTC](https://discuss.elastic.co/t/exceptions-matches-escaping/366374 "2024-09-23T11:50:52Z")
We've encountered this rather annoying problem when writing exceptions the documentation on Add and manage exceptions states following: Some characters must be escaped with a backslash, such as \\\\ for a literal backsla… --- ## [Elastic Security 8.14.3 cannot install into macOS - Sequoia](https://discuss.elastic.co/t/elastic-security-8-14-3-cannot-install-into-macos-sequoia/366743)
**Author:** [@Train](https://discuss.elastic.co/u/Train)\ **Replies:** 2\ **Last updated:** [September 18, 2024, 3:45pm UTC](https://discuss.elastic.co/t/elastic-security-8-14-3-cannot-install-into-macos-sequoia/366743 "2024-09-18T15:45:32Z")
When macOS - Sequoia is reinstalled into my device and try to install elastic security 8.14.3 with Fleet Server 8.14.3. However, it is not worked. Is it caused version 8.14.3 is not compatible with macOS - Sequoia or no… --- ## [Problem with CrowdStrike](https://discuss.elastic.co/t/problem-with-crowdstrike/365146)
**Author:** [@sbeaudoin](https://discuss.elastic.co/u/sbeaudoin)\ **Replies:** 13\ **Last updated:** [September 17, 2024, 12:40pm UTC](https://discuss.elastic.co/t/problem-with-crowdstrike/365146 "2024-09-17T12:40:44Z")
Hello everyone, I want to integrate crowdstrike on my siem, the kibana interface. I have already preconfigured the following: Generation id and secret: https://api.eu-1.crowdstrike.com. Integration and preconfigu… --- ## [I have tons of closed alerts , how to delete all of them](https://discuss.elastic.co/t/i-have-tons-of-closed-alerts-how-to-delete-all-of-them/366189)
**Author:** [@Haitham1](https://discuss.elastic.co/u/Haitham1)\ **Replies:** 2\ **Last updated:** [September 16, 2024, 5:17pm UTC](https://discuss.elastic.co/t/i-have-tons-of-closed-alerts-how-to-delete-all-of-them/366189 "2024-09-16T17:17:51Z")
am running an instance where am still experimenting with rules am getting a lot of false alerts that i want to delete before push production thanks --- ## [Email alerts syntax issue](https://discuss.elastic.co/t/email-alerts-syntax-issue/366610)
**Author:** [@aman\_kumar4](https://discuss.elastic.co/u/aman_kumar4)\ **Replies:** 3\ **Last updated:** [September 16, 2024, 2:16pm UTC](https://discuss.elastic.co/t/email-alerts-syntax-issue/366610 "2024-09-16T14:16:50Z")
I have created a security alert by defining the proper rules ( i am using custom query in defination where I have written the query as "username: missing\_name" uploaded a csv in which there is a column "username" if the… [Previous page](https://discuss.elastic.co/c/security/83.md?page=9) [Next page](https://discuss.elastic.co/c/security/83.md?page=11)