# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=12 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 13 --- ## [Set alert columns per rule](https://discuss.elastic.co/t/set-alert-columns-per-rule/364590)
**Author:** [@Rihards](https://discuss.elastic.co/u/Rihards)\ **Replies:** 0\ **Last updated:** [August 8, 2024, 9:19am UTC](https://discuss.elastic.co/t/set-alert-columns-per-rule/364590 "2024-08-08T09:19:03Z")
Viewing security rule alerts (lower part of the security rule page), they have wildly different fields (columns) that are useful to display. Customising them for one rule makes the view useless for another rule. How cou… --- ## [No index matching for Windows Forwarded events](https://discuss.elastic.co/t/no-index-matching-for-windows-forwarded-events/364465)
**Author:** [@isever24](https://discuss.elastic.co/u/isever24)\ **Replies:** 2\ **Last updated:** [August 7, 2024, 8:52am UTC](https://discuss.elastic.co/t/no-index-matching-for-windows-forwarded-events/364465 "2024-08-07T08:52:23Z")
I am sending Windows events over WEC server on which Elastic Agent is installed and is sending events to Elasticsearch. By default events are put into indexes with pattern "logs-windows.forwarded-default", and it looks … --- ## [Timeline template isn't being applied properly over threshold rules](https://discuss.elastic.co/t/timeline-template-isnt-being-applied-properly-over-threshold-rules/364474)
**Author:** [@elk-siem-user](https://discuss.elastic.co/u/elk-siem-user)\ **Replies:** 0\ **Last updated:** [August 6, 2024, 12:58pm UTC](https://discuss.elastic.co/t/timeline-template-isnt-being-applied-properly-over-threshold-rules/364474 "2024-08-06T12:58:49Z")
Hi community, Am relatively new to Elastic SIEM feature - Timeline and wanted to understand if am missing out anything or its intentionally built that way. We are building a detection based on threshold rule with custo… --- ## [Filter Options for Threat Intel IP Address Alert](https://discuss.elastic.co/t/filter-options-for-threat-intel-ip-address-alert/364417)
**Author:** [@rwillis](https://discuss.elastic.co/u/rwillis)\ **Replies:** 1\ **Last updated:** [August 5, 2024, 9:55pm UTC](https://discuss.elastic.co/t/filter-options-for-threat-intel-ip-address-alert/364417 "2024-08-05T21:55:43Z")
Greetings, I am attempting to customize our Threat Intel IP Address Indicator alert message. Currently this is what we have in the message: Rule {{context.rule.name}} generated {{state.signals\_count}} alerts What … --- ## [My low priority alerts are not showing in alerts?](https://discuss.elastic.co/t/my-low-priority-alerts-are-not-showing-in-alerts/363291)
**Author:** [@CtrlCloud-Jelle](https://discuss.elastic.co/u/CtrlCloud-Jelle)\ **Replies:** 1\ **Last updated:** [August 5, 2024, 4:02pm UTC](https://discuss.elastic.co/t/my-low-priority-alerts-are-not-showing-in-alerts/363291 "2024-08-05T16:02:28Z")
So I've set some rules in the Security solution, and in the Alerts dashboard (Detection and Response) it shows me the alert has fired (which was me that did that). Now when I click the 2 open alerts, it shows nothing… --- ## [Kibana alerts with cusotm fields](https://discuss.elastic.co/t/kibana-alerts-with-cusotm-fields/363523)
**Author:** [@Marek\_Galbavy](https://discuss.elastic.co/u/Marek_Galbavy)\ **Replies:** 1\ **Last updated:** [August 5, 2024, 1:36pm UTC](https://discuss.elastic.co/t/kibana-alerts-with-cusotm-fields/363523 "2024-08-05T13:36:09Z")
Hi i try to create custom rule which find communication for more than 250 destination.ports. My problem is when the alert is created i dont have information which ports was in this communication. this is my ESQL from l… --- ## [Elastic Defend backward compatibility](https://discuss.elastic.co/t/elastic-defend-backward-compatibility/364144)
**Author:** [@daniel-san](https://discuss.elastic.co/u/daniel-san)\ **Replies:** 6\ **Last updated:** [August 5, 2024, 6:23am UTC](https://discuss.elastic.co/t/elastic-defend-backward-compatibility/364144 "2024-08-05T06:23:46Z")
Hello there, recently i've digged through the available elastic compatibility matrix and cant find any related informations. Question/Example: Is Elastic Defend Version 8.14.x compatible with lets say Elastic Agent 8.… --- ## [Unable to source and feed in the correct information in src country](https://discuss.elastic.co/t/unable-to-source-and-feed-in-the-correct-information-in-src-country/364019)
**Author:** [@SandeshS](https://discuss.elastic.co/u/SandeshS)\ **Replies:** 3\ **Last updated:** [August 4, 2024, 11:05pm UTC](https://discuss.elastic.co/t/unable-to-source-and-feed-in-the-correct-information-in-src-country/364019 "2024-08-04T23:05:37Z")
Hi all, How do I get correct country source in all my fortigate logs? Currently all my logins are showing from a random country for VPN. --- ## [macOS Sequoia (15.x) Support](https://discuss.elastic.co/t/macos-sequoia-15-x-support/364235)
**Author:** [@0xmachos](https://discuss.elastic.co/u/0xmachos)\ **Replies:** 2\ **Last updated:** [August 2, 2024, 5:07pm UTC](https://discuss.elastic.co/t/macos-sequoia-15-x-support/364235 "2024-08-02T17:07:41Z")
When I install Elastic Agent on macOS 15 Beta 3 (24A5289g) I get the following error sudo elastic-agent status ┌─ fleet │ └─ status: (HEALTHY) Connected └─ elastic-agent ├─ status: (DEGRADED) 1 or more components/u… --- ## [Attack Discovery Questions and Feedback](https://discuss.elastic.co/t/attack-discovery-questions-and-feedback/364109)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 3\ **Last updated:** [August 1, 2024, 4:34pm UTC](https://discuss.elastic.co/t/attack-discovery-questions-and-feedback/364109 "2024-08-01T16:34:17Z")
Hello, So we updated to 8.14.3 earlier this week and I had the chance to play a bit with the Attack Discovery feature. It started by hitting the max content length of 8K tokens a lot. Asked our Azure engineer to pro… --- ## [Is there any way to load elastic prebuilt rules by using command?](https://discuss.elastic.co/t/is-there-any-way-to-load-elastic-prebuilt-rules-by-using-command/363611)
**Author:** [@lilyyy](https://discuss.elastic.co/u/lilyyy)\ **Replies:** 2\ **Last updated:** [July 31, 2024, 8:08am UTC](https://discuss.elastic.co/t/is-there-any-way-to-load-elastic-prebuilt-rules-by-using-command/363611 "2024-07-31T08:08:14Z")
Hello. I can load Elastic prebuilt rules and timeline templates by clicking in kibana. But I want to know if I can load Elastic prebuilt rules and timeline templates by sending a command not click. The reason why I … --- ## [Elastic CSPM Azure Exclude resources from rules](https://discuss.elastic.co/t/elastic-cspm-azure-exclude-resources-from-rules/364057)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [July 30, 2024, 2:01pm UTC](https://discuss.elastic.co/t/elastic-cspm-azure-exclude-resources-from-rules/364057 "2024-07-30T14:01:38Z")
Hello, What we are missing in Elastic CSPM is a way to exclude resources from certain rules. Some rules are triggering on all resources, while these rules are not applicable to these resources. For example: Ensure the… --- ## [ES|QL - span](https://discuss.elastic.co/t/es-ql-span/364021)
**Author:** [@Marek\_Galbavy](https://discuss.elastic.co/u/Marek_Galbavy)\ **Replies:** 4\ **Last updated:** [July 30, 2024, 6:33am UTC](https://discuss.elastic.co/t/es-ql-span/364021 "2024-07-30T06:33:10Z")
Hi i create a new topic as a advice of your team: I want to create a rule that will detect the upload of a large amount of data from my network. The rule works as I want, except that I have to run it every minute to gro… --- ## [Host an air-gapped Elastic Endpoint artifact server](https://discuss.elastic.co/t/host-an-air-gapped-elastic-endpoint-artifact-server/363870)
**Author:** [@devilman85](https://discuss.elastic.co/u/devilman85)\ **Replies:** 7\ **Last updated:** [July 29, 2024, 6:54am UTC](https://discuss.elastic.co/t/host-an-air-gapped-elastic-endpoint-artifact-server/363870 "2024-07-29T06:54:59Z")
I have followed the official guide in the subject does not update the signatures despite creating the ngnix server for the files. How can I solve this? --- ## [Disable HTTP OPTIONS on port 9200](https://discuss.elastic.co/t/disable-http-options-on-port-9200/363824)
**Author:** [@bhupendra.mskhatri](https://discuss.elastic.co/u/bhupendra.mskhatri)\ **Replies:** 6\ **Last updated:** [July 29, 2024, 4:16am UTC](https://discuss.elastic.co/t/disable-http-options-on-port-9200/363824 "2024-07-29T04:16:02Z")
How to disable HTTP OPTIONS on port 9200 which our scan tool is flagging as a vulnerability. If we cannot, could you please share a reason that I could share with my security team (link to a document would be prefarable… --- ## [Information about the endpoint.metrics dataset](https://discuss.elastic.co/t/information-about-the-endpoint-metrics-dataset/363873)
**Author:** [@popeio](https://discuss.elastic.co/u/popeio)\ **Replies:** 0\ **Last updated:** [July 26, 2024, 3:23pm UTC](https://discuss.elastic.co/t/information-about-the-endpoint-metrics-dataset/363873 "2024-07-26T15:23:28Z")
Hello there, Recently we've begun tinkering with a peculiar dataset named endpoint.metrics, which reports a number of performance metrics once a day (it seems) and upon every policy change. For what it's worth, we are … --- ## [Elastic - Event Filtering](https://discuss.elastic.co/t/elastic-event-filtering/363694)
**Author:** [@Charles\_Nkuna](https://discuss.elastic.co/u/Charles_Nkuna)\ **Replies:** 5\ **Last updated:** [July 25, 2024, 5:27am UTC](https://discuss.elastic.co/t/elastic-event-filtering/363694 "2024-07-25T05:27:48Z")
Hi, Please assist i have tried to apply event filtering on multiple of process name and applied globally but i'm still seeing the events triggering and i cant apply process names on Trusted Applications due to there's … --- ## [\[Elastic Security/SIEM\] - Detect if a source IP contacts more destination IPs or more destination ports](https://discuss.elastic.co/t/elastic-security-siem-detect-if-a-source-ip-contacts-more-destination-ips-or-more-destination-ports/362850)
**Author:** [@vowag](https://discuss.elastic.co/u/vowag)\ **Replies:** 1\ **Last updated:** [July 24, 2024, 11:15am UTC](https://discuss.elastic.co/t/elastic-security-siem-detect-if-a-source-ip-contacts-more-destination-ips-or-more-destination-ports/362850 "2024-07-24T11:15:33Z")
Hi all, I'm new to Elastic and I need to make a detection rule that detects if more than 200 unique destination IPs were accessed from same source IP and if more that 400 unique destination ports are accessed from same… --- ## [Indicator matching rule with MISP intel with too long duration](https://discuss.elastic.co/t/indicator-matching-rule-with-misp-intel-with-too-long-duration/363617)
**Author:** [@hectorGC](https://discuss.elastic.co/u/hectorGC)\ **Replies:** 0\ **Last updated:** [July 23, 2024, 9:20am UTC](https://discuss.elastic.co/t/indicator-matching-rule-with-misp-intel-with-too-long-duration/363617 "2024-07-23T09:20:53Z")
Hi all, I am testing MISP integration with a indicator match rule. In the past our team suffered a small outage of a node due to a long execution duration fulfilling the java garbage collector. We are trying again to u… --- ## [Calculate response time for alerts](https://discuss.elastic.co/t/calculate-response-time-for-alerts/362141)
**Author:** [@abubacker](https://discuss.elastic.co/u/abubacker)\ **Replies:** 9\ **Last updated:** [July 23, 2024, 8:44am UTC](https://discuss.elastic.co/t/calculate-response-time-for-alerts/362141 "2024-07-23T08:44:36Z")
Dear All I need to calculate response time from security alerts open to ack to closed currently, from Kibana alerts logs, I'm able to get alert start time but when we ack or close time is not logged in alerts only work… --- ## [Error using Detection-rule CLI](https://discuss.elastic.co/t/error-using-detection-rule-cli/363577)
**Author:** [@Vm\_Elastic](https://discuss.elastic.co/u/Vm_Elastic)\ **Replies:** 1\ **Last updated:** [July 23, 2024, 8:11am UTC](https://discuss.elastic.co/t/error-using-detection-rule-cli/363577 "2024-07-23T08:11:43Z")
Getting: CLI Error(valueError): Unsupported rule type new\_terms. Unable to downgrade to 8.14 in version: 8.14.3, for rule: ... Why am I getting this error ?? --- ## [Defend integration, agent unhealthy, failed install and exist status 213](https://discuss.elastic.co/t/defend-integration-agent-unhealthy-failed-install-and-exist-status-213/363579)
**Author:** [@Adair\_Torres](https://discuss.elastic.co/u/Adair_Torres)\ **Replies:** 1\ **Last updated:** [July 22, 2024, 5:20pm UTC](https://discuss.elastic.co/t/defend-integration-agent-unhealthy-failed-install-and-exist-status-213/363579 "2024-07-22T17:20:58Z")
After the agent was reinstalled on a device, the Elastic Defend integration began showing an error of: "failed install endpoint service ... exit status 213". Which is installation failure from pre-existing files. I've f… --- ## [Hashcat signature](https://discuss.elastic.co/t/hashcat-signature/363509)
**Author:** [@FranklinFurter](https://discuss.elastic.co/u/FranklinFurter)\ **Replies:** 2\ **Last updated:** [July 22, 2024, 12:01pm UTC](https://discuss.elastic.co/t/hashcat-signature/363509 "2024-07-22T12:01:41Z")
So i've discovered that there's a signature built in to endpoint defend that simply checks if a process is named "hashcat" and kills it as unwanted. While I get the spirit of this rule, it causes some issues. First off,… --- ## [Identifying User Who Acknowledged Security Alerts](https://discuss.elastic.co/t/identifying-user-who-acknowledged-security-alerts/363448)
**Author:** [@ej210](https://discuss.elastic.co/u/ej210)\ **Replies:** 1\ **Last updated:** [July 22, 2024, 10:45am UTC](https://discuss.elastic.co/t/identifying-user-who-acknowledged-security-alerts/363448 "2024-07-22T10:45:14Z")
Hello, I have not been able to find any documentation or threads but apparently there might be a way to track who acknowledged alerts within Kibana Security, it appears the field "kibana.alert.workflow\_assignment\_ids" co… --- ## [Elastic XDR Malware Classification](https://discuss.elastic.co/t/elastic-xdr-malware-classification/363539)
**Author:** [@Charles\_Nkuna](https://discuss.elastic.co/u/Charles_Nkuna)\ **Replies:** 0\ **Last updated:** [July 22, 2024, 9:18am UTC](https://discuss.elastic.co/t/elastic-xdr-malware-classification/363539 "2024-07-22T09:18:03Z")
Hi, Anyone can assist? running the Elastic Defend .. is it possible to see malware classification on Elastic Platform for example types of malware? Adware, PUP etc ? if so how do we go about it/which query you must r… --- ## [Linux Defend doesn't detect EICAR](https://discuss.elastic.co/t/linux-defend-doesnt-detect-eicar/362647)
**Author:** [@FranklinFurter](https://discuss.elastic.co/u/FranklinFurter)\ **Replies:** 6\ **Last updated:** [July 20, 2024, 12:57am UTC](https://discuss.elastic.co/t/linux-defend-doesnt-detect-eicar/362647 "2024-07-20T00:57:08Z")
I've been testing out Elastic Endpoint/Defend for Linux and i'm not sure if it's not setup correctly or what. The standard test of downloading the eicar file (of various forms) didn't trigger the malware sigantures for d… --- ## [Fix for CVE-2023-52428 in logstash](https://discuss.elastic.co/t/fix-for-cve-2023-52428-in-logstash/363288)
**Author:** [@joniba](https://discuss.elastic.co/u/joniba)\ **Replies:** 2\ **Last updated:** [July 17, 2024, 3:12pm UTC](https://discuss.elastic.co/t/fix-for-cve-2023-52428-in-logstash/363288 "2024-07-17T15:12:14Z")
Looking for fix for CVE-2023-52428 for logstash. Anyone know if there is a plan for when it will be released? It just needs an upgrade to the com.nimbusds/nimbus-jose-jwt packge. --- ## [Elastic - user account](https://discuss.elastic.co/t/elastic-user-account/363263)
**Author:** [@Charles\_Nkuna](https://discuss.elastic.co/u/Charles_Nkuna)\ **Replies:** 1\ **Last updated:** [July 17, 2024, 12:42pm UTC](https://discuss.elastic.co/t/elastic-user-account/363263 "2024-07-17T12:42:26Z")
In Elasticsearch how to find the user account that an alert is assigned to? --- ## [Help with cpu utilization - Elastic Cloud](https://discuss.elastic.co/t/help-with-cpu-utilization-elastic-cloud/363230)
**Author:** [@LaserBits](https://discuss.elastic.co/u/LaserBits)\ **Replies:** 2\ **Last updated:** [July 17, 2024, 8:00am UTC](https://discuss.elastic.co/t/help-with-cpu-utilization-elastic-cloud/363230 "2024-07-17T08:00:06Z")
Hello I am new to elastic stack and need some help. I use the elastic cloud for the Siem functionality and the endpoint defend. Everything is good but I get very high cpu utilization that makes it difficult for me to us… --- ## [DSL query from investigate timeline](https://discuss.elastic.co/t/dsl-query-from-investigate-timeline/362997)
**Author:** [@vhs](https://discuss.elastic.co/u/vhs)\ **Replies:** 5\ **Last updated:** [July 16, 2024, 7:11am UTC](https://discuss.elastic.co/t/dsl-query-from-investigate-timeline/362997 "2024-07-16T07:11:20Z")
Please tell me, is it possible to take information from the "investigate in timeline" elastic security alert, which is located in the Inspect-\>Request tab? Or maybe it is possible to universally convert the request rece… [Previous page](https://discuss.elastic.co/c/security/83.md?page=11) [Next page](https://discuss.elastic.co/c/security/83.md?page=13)