# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=11 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 12 --- ## [Fortigate Integrations](https://discuss.elastic.co/t/fortigate-integrations/366211)
**Author:** [@arcsons](https://discuss.elastic.co/u/arcsons)\ **Replies:** 8\ **Last updated:** [September 12, 2024, 6:36pm UTC](https://discuss.elastic.co/t/fortigate-integrations/366211 "2024-09-12T18:36:51Z")
Hi there, I'm a beginner with Elastic and I'm trying to add the "Fortinet FortiGate Firewall Logs" integration to my Elastic setup. I have configured my firewall to send syslog messages to UDP port 9004 on host 192.168.… --- ## [Elastic Defend Licensing](https://discuss.elastic.co/t/elastic-defend-licensing/366405)
**Author:** [@mike123](https://discuss.elastic.co/u/mike123)\ **Replies:** 3\ **Last updated:** [September 12, 2024, 3:45am UTC](https://discuss.elastic.co/t/elastic-defend-licensing/366405 "2024-09-12T03:45:53Z")
Hi team, We are analyzing Elastic stack for our security needs. we are testing Elastic defend for forwarding logs. After the Elastic Agent is installed with the Elastic Defend integration, several protections features —… --- ## [FIM and Windows Updates Best Practices](https://discuss.elastic.co/t/fim-and-windows-updates-best-practices/366415)
**Author:** [@csmith](https://discuss.elastic.co/u/csmith)\ **Replies:** 0\ **Last updated:** [September 11, 2024, 2:04pm UTC](https://discuss.elastic.co/t/fim-and-windows-updates-best-practices/366415 "2024-09-11T14:04:26Z")
Hi all, When using the File Integrity Module integration, is there a way to tune out expected behavior from Windows updates? Been having a lot of alerts following regular updates. EDIT: I thought about adding an except… --- ## [Slow Event Analyzer queries](https://discuss.elastic.co/t/slow-event-analyzer-queries/365933)
**Author:** [@lduvnjak](https://discuss.elastic.co/u/lduvnjak)\ **Replies:** 3\ **Last updated:** [September 10, 2024, 2:04pm UTC](https://discuss.elastic.co/t/slow-event-analyzer-queries/365933 "2024-09-10T14:04:48Z")
Hey Everyone, I'm having some issues with the Event Analyzer for Elastic Defender rules. They are extremely slow and time out quite often. With the default elasticsearch.requestTimeout set to 30000 almost all of them … --- ## [Security Case Data for Custom Dashboard](https://discuss.elastic.co/t/security-case-data-for-custom-dashboard/365973)
**Author:** [@sourcreamnormanbates](https://discuss.elastic.co/u/sourcreamnormanbates)\ **Replies:** 1\ **Last updated:** [September 5, 2024, 12:34pm UTC](https://discuss.elastic.co/t/security-case-data-for-custom-dashboard/365973 "2024-09-05T12:34:54Z")
I want to include information about open/closed cases in a custom KPI dashboard. I'm not seeing which index to pull that information from. Does anyone know how I could locate that? --- ## [Trying to send all security alerts to a custom webhook](https://discuss.elastic.co/t/trying-to-send-all-security-alerts-to-a-custom-webhook/366071)
**Author:** [@John\_Bambenek](https://discuss.elastic.co/u/John_Bambenek)\ **Replies:** 2\ **Last updated:** [September 5, 2024, 12:19pm UTC](https://discuss.elastic.co/t/trying-to-send-all-security-alerts-to-a-custom-webhook/366071 "2024-09-05T12:19:40Z")
I'm trying to send all security alerts generated in Elastic automatically to a webhook that I'll need to wrap some additional JSON (the entire log needs to be in an "alert" field, it's easy enough to do via copy-paste). … --- ## [Kibana Embed](https://discuss.elastic.co/t/kibana-embed/366092)
**Author:** [@OAJ](https://discuss.elastic.co/u/OAJ)\ **Replies:** 4\ **Last updated:** [September 5, 2024, 11:01am UTC](https://discuss.elastic.co/t/kibana-embed/366092 "2024-09-05T11:01:56Z")
Hi all, Does Kibana allow embed from external sources into my dashboard. As an iframe. Even if its static site. Thanks in advance --- ## [What is session\_id\_change in event.action?](https://discuss.elastic.co/t/what-is-session-id-change-in-event-action/365950)
**Author:** [@Moros\_ntd](https://discuss.elastic.co/u/Moros_ntd)\ **Replies:** 3\ **Last updated:** [September 4, 2024, 7:51am UTC](https://discuss.elastic.co/t/what-is-session-id-change-in-event-action/365950 "2024-09-04T07:51:34Z")
I'm using the "Suspicious Network Connection Attempt by Root" rule in Elastic, but I don't really understand it. I don't know how to trigger this rule through an attack because I don't understand why it needs to catch th… --- ## [Rule Failure](https://discuss.elastic.co/t/rule-failure/364792)
**Author:** [@ETFJeff](https://discuss.elastic.co/u/ETFJeff)\ **Replies:** 4\ **Last updated:** [September 3, 2024, 5:09pm UTC](https://discuss.elastic.co/t/rule-failure/364792 "2024-09-03T17:09:59Z")
Hi, I have the following rule failure: /An error occurred during rule execution: message: "verification\_exception Root causes: verification\_exception: Found 1 problem line 3:3: Unknown column \[winlog.event\_data.Attr… --- ## [Elastic Endpoint (Defend) does not seem to report file hashes for writes or modifications](https://discuss.elastic.co/t/elastic-endpoint-defend-does-not-seem-to-report-file-hashes-for-writes-or-modifications/365785)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 7\ **Last updated:** [September 3, 2024, 2:05pm UTC](https://discuss.elastic.co/t/elastic-endpoint-defend-does-not-seem-to-report-file-hashes-for-writes-or-modifications/365785 "2024-09-03T14:05:32Z")
Hey all, this is similar to: Endpoint events dont contain process or file hash When I look at fields in the endpoint\* datasets, the fields file.hash.\* are not populated. I see process.hash.\* on events in the dataset en… --- ## [Question Regarding OpenSource License Change for Detection Rules Repository](https://discuss.elastic.co/t/question-regarding-opensource-license-change-for-detection-rules-repository/365965)
**Author:** [@JcabreraC](https://discuss.elastic.co/u/JcabreraC)\ **Replies:** 0\ **Last updated:** [September 3, 2024, 1:58pm UTC](https://discuss.elastic.co/t/question-regarding-opensource-license-change-for-detection-rules-repository/365965 "2024-09-03T13:58:30Z")
Hello, Based on your recent blog post (link), I have a question: Will the OpenSource license change also apply to repositories like detection-rules? If so, do you have a timeline for when this change will take place? … --- ## [List all Rules Exceptions](https://discuss.elastic.co/t/list-all-rules-exceptions/365756)
**Author:** [@aptfinf](https://discuss.elastic.co/u/aptfinf)\ **Replies:** 3\ **Last updated:** [August 29, 2024, 4:39pm UTC](https://discuss.elastic.co/t/list-all-rules-exceptions/365756 "2024-08-29T16:39:03Z")
Hello to everyone. I'm exploring Elastic Defend in a self-hosted cluster with Basic license. I have a question: if i add a Rule Exception (without using Shared Exceptions Lists), is there a way to list all exceptions c… --- ## [Hunt dashboard](https://discuss.elastic.co/t/hunt-dashboard/365764)
**Author:** [@feboxa1431](https://discuss.elastic.co/u/feboxa1431)\ **Replies:** 0\ **Last updated:** [August 29, 2024, 11:42am UTC](https://discuss.elastic.co/t/hunt-dashboard/365764 "2024-08-29T11:42:28Z")
Hello, Could you help me to understand if in Elastic is such option as "HUNT dashboard" in Security Onion? I mean, is in Elastic such opportunity to aggregate alerts on the dashboard and if so, could you help me to do … --- ## [Security cases auto-numbering](https://discuss.elastic.co/t/security-cases-auto-numbering/365670)
**Author:** [@adis3421](https://discuss.elastic.co/u/adis3421)\ **Replies:** 0\ **Last updated:** [August 28, 2024, 9:08am UTC](https://discuss.elastic.co/t/security-cases-auto-numbering/365670 "2024-08-28T09:08:11Z")
Hi, ICzy elastic ma w planach wprowadzenie automatyczne numerowanie spraw? W moim przypadku ułatwilo by to wiele wątków. Regards, AN --- ## [Elastic Defend Integration using Terraform](https://discuss.elastic.co/t/elastic-defend-integration-using-terraform/365583)
**Author:** [@alextg](https://discuss.elastic.co/u/alextg)\ **Replies:** 4\ **Last updated:** [August 27, 2024, 9:23pm UTC](https://discuss.elastic.co/t/elastic-defend-integration-using-terraform/365583 "2024-08-27T21:23:32Z")
Hi, Working in creating an agent policy with 3 integrations using terraform, first 2 integrations are completed, however the defend integration is giving issues. Can someone correct/advise how to defined the defend inte… --- ## [DNS Tunneling job failing to start](https://discuss.elastic.co/t/dns-tunneling-job-failing-to-start/365635)
**Author:** [@csmith](https://discuss.elastic.co/u/csmith)\ **Replies:** 0\ **Last updated:** [August 27, 2024, 4:56pm UTC](https://discuss.elastic.co/t/dns-tunneling-job-failing-to-start/365635 "2024-08-27T16:56:02Z")
I have a similar issue to this thread (Anomaly detection - Elastic Jobs failing to start). When I try to start the job packetbeat\_dns\_tunneling, I get the error \[datafeed-packetbeat\_dns\_tunneling\] cannot retrieve field … --- ## [Native vs DaemonSet Deployment for Integrations Defend, Kubernetes, KSPM](https://discuss.elastic.co/t/native-vs-daemonset-deployment-for-integrations-defend-kubernetes-kspm/323535)
**Author:** [@mag-mkorn](https://discuss.elastic.co/u/mag-mkorn)\ **Replies:** 4\ **Last updated:** [August 26, 2024, 6:46pm UTC](https://discuss.elastic.co/t/native-vs-daemonset-deployment-for-integrations-defend-kubernetes-kspm/323535 "2024-08-26T18:46:12Z")
Hi everyone, I have a question regarding deployment of the Agent on Kubernetes environment. I want to use the following Integrations for monitoring our clusters: Elastic Defend for Cloud Workloads Kubernetes Kubernet… --- ## [Can you guys suggest some courses or training about using ELK in soc as a SIEM, XDR, threat hunting, IR or anything related to SOC please?](https://discuss.elastic.co/t/can-you-guys-suggest-some-courses-or-training-about-using-elk-in-soc-as-a-siem-xdr-threat-hunting-ir-or-anything-related-to-soc-please/365563)
**Author:** [@Abdarrahmane](https://discuss.elastic.co/u/Abdarrahmane)\ **Replies:** 1\ **Last updated:** [August 26, 2024, 5:42pm UTC](https://discuss.elastic.co/t/can-you-guys-suggest-some-courses-or-training-about-using-elk-in-soc-as-a-siem-xdr-threat-hunting-ir-or-anything-related-to-soc-please/365563 "2024-08-26T17:42:37Z")
Can you guys suggest some courses or training about using ELK in soc as an SIEM, XDR, or for thread hunting, Incident Response or anything related to SOC please ? any website or platform would help thank you ! --- ## [ElasticDefend Integration is installed but API says otherwise](https://discuss.elastic.co/t/elasticdefend-integration-is-installed-but-api-says-otherwise/363428)
**Author:** [@priamaiai](https://discuss.elastic.co/u/priamaiai)\ **Replies:** 3\ **Last updated:** [August 26, 2024, 2:03pm UTC](https://discuss.elastic.co/t/elasticdefend-integration-is-installed-but-api-says-otherwise/363428 "2024-08-26T14:03:32Z")
I am on Elasticsearch Free Enterprise Trial version 8.12.2 Version I have enabled the Elastic Defend integration on the integration policy of the agent. I can see the agent is enabled. However when I try to issue … --- ## [Installing Elastic Agent with GPO](https://discuss.elastic.co/t/installing-elastic-agent-with-gpo/364659)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 13\ **Last updated:** [August 22, 2024, 12:03pm UTC](https://discuss.elastic.co/t/installing-elastic-agent-with-gpo/364659 "2024-08-22T12:03:35Z")
Im looking to deploy Elastic Agent via a GPO. What is the best way to do it? It should autoenroll onto Fleet without any manual token needed --- ## [Defend exclusion by parent signature?](https://discuss.elastic.co/t/defend-exclusion-by-parent-signature/365075)
**Author:** [@FranklinFurter](https://discuss.elastic.co/u/FranklinFurter)\ **Replies:** 3\ **Last updated:** [August 19, 2024, 7:19pm UTC](https://discuss.elastic.co/t/defend-exclusion-by-parent-signature/365075 "2024-08-19T19:19:53Z")
I recently ran into an issue where Defend is triggering on suspicious activity. Unfortunately, the suspicious activity is due to a legitimate software install that is adding itself to the windows defender exclusions dire… --- ## [How to write elastic security events to a separate index?](https://discuss.elastic.co/t/how-to-write-elastic-security-events-to-a-separate-index/364999)
**Author:** [@vhs](https://discuss.elastic.co/u/vhs)\ **Replies:** 1\ **Last updated:** [August 19, 2024, 4:36pm UTC](https://discuss.elastic.co/t/how-to-write-elastic-security-events-to-a-separate-index/364999 "2024-08-19T16:36:03Z")
I pick up elastic security events, add one field and want to write them into a separate index? How can I do this? I constantly encounter mapping problems; I can’t extract mapping from the built-in indexes and add it to m… --- ## [Elastic Agent Cloudflare Integration using S3 Compatible Bucket](https://discuss.elastic.co/t/elastic-agent-cloudflare-integration-using-s3-compatible-bucket/364561)
**Author:** [@jcruz](https://discuss.elastic.co/u/jcruz)\ **Replies:** 2\ **Last updated:** [August 19, 2024, 2:25pm UTC](https://discuss.elastic.co/t/elastic-agent-cloudflare-integration-using-s3-compatible-bucket/364561 "2024-08-19T14:25:22Z")
Hello, I'm trying to use Elastic Agent to collect log data using Cloudflare Integration, collecting those logs from a S3 compatible Bucket (Oracle Cloud), however it's only availble options to collect from AWS S3 or Goog… --- ## [What is the best way to secure the cluster?](https://discuss.elastic.co/t/what-is-the-best-way-to-secure-the-cluster/364952)
**Author:** [@cassper](https://discuss.elastic.co/u/cassper)\ **Replies:** 1\ **Last updated:** [August 15, 2024, 12:43pm UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-secure-the-cluster/364952 "2024-08-15T12:43:26Z")
Hello Team, I saw there is a blog related to intellectual property theft in searchguard? I think now ES includes all the free security features. still don't you recommend to use the searchgurad? --- ## [Azure Logs integration stops pulling events](https://discuss.elastic.co/t/azure-logs-integration-stops-pulling-events/364891)
**Author:** [@isever24](https://discuss.elastic.co/u/isever24)\ **Replies:** 0\ **Last updated:** [August 14, 2024, 7:37am UTC](https://discuss.elastic.co/t/azure-logs-integration-stops-pulling-events/364891 "2024-08-14T07:37:32Z")
Hello, We are pulling Azure Entra signin events through Azure event hub. It works for few days and then it stops working and we need to restart Elastic agent. Error is: 50\]: 2024/08/13 22:23:58 ==\> REQUEST/RESPONSE (… --- ## [Restricting rights to detection rules](https://discuss.elastic.co/t/restricting-rights-to-detection-rules/364777)
**Author:** [@marcou](https://discuss.elastic.co/u/marcou)\ **Replies:** 1\ **Last updated:** [August 13, 2024, 10:01am UTC](https://discuss.elastic.co/t/restricting-rights-to-detection-rules/364777 "2024-08-13T10:01:10Z")
Hello, we would like to give our analysts the option to create detection rules, but they should not be able to activate them. The engineer should only be able to activate them after an engineer has looked at them. Howe… --- ## [Complete Elastic modules port details](https://discuss.elastic.co/t/complete-elastic-modules-port-details/364779)
**Author:** [@sunith](https://discuss.elastic.co/u/sunith)\ **Replies:** 0\ **Last updated:** [August 12, 2024, 1:40pm UTC](https://discuss.elastic.co/t/complete-elastic-modules-port-details/364779 "2024-08-12T13:40:07Z")
Hi Team, I am looking for a complete details or a website link which tells us all Elastic SIEM solution internal port communication details. Reason for asking with this complete port details would help us in opening fi… --- ## [Timeline filter always overwriting first value](https://discuss.elastic.co/t/timeline-filter-always-overwriting-first-value/364666)
**Author:** [@j91321](https://discuss.elastic.co/u/j91321)\ **Replies:** 1\ **Last updated:** [August 9, 2024, 6:34pm UTC](https://discuss.elastic.co/t/timeline-filter-always-overwriting-first-value/364666 "2024-08-09T18:34:27Z")
Hi, I'm having this strange problem (possibly a bug) with timelines in Kibana 8.12.2. When I try to add multiple filters in the timeline builder (the ones under KQL query). The second filter always replaces the first on… --- ## [Email Notification Template](https://discuss.elastic.co/t/email-notification-template/364646)
**Author:** [@amjadkhan\_291](https://discuss.elastic.co/u/amjadkhan_291)\ **Replies:** 1\ **Last updated:** [August 9, 2024, 7:41am UTC](https://discuss.elastic.co/t/email-notification-template/364646 "2024-08-09T07:41:37Z")
Hello, I am looking for Email Notification template to configure in Alert Actions. Please share. Thank You. --- ## [Detection Exception for Lenovo Temp Account Creation](https://discuss.elastic.co/t/detection-exception-for-lenovo-temp-account-creation/364621)
**Author:** [@FlyNavy](https://discuss.elastic.co/u/FlyNavy)\ **Replies:** 0\ **Last updated:** [August 8, 2024, 5:51pm UTC](https://discuss.elastic.co/t/detection-exception-for-lenovo-temp-account-creation/364621 "2024-08-08T17:51:56Z")
I have a series of 4 events being generated when the Lenovo Update application runs on a Windows computer. Create account lenovo\_tmp\_####$$$$ (eventID 4720) Enable account lenovo\_tmp\_####$$$$ (eventID 4722) Add lenovo\_… [Previous page](https://discuss.elastic.co/c/security/83.md?page=10) [Next page](https://discuss.elastic.co/c/security/83.md?page=12)