# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=13 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 14 --- ## [Threshold security rule](https://discuss.elastic.co/t/threshold-security-rule/362464)
**Author:** [@luizmeireles](https://discuss.elastic.co/u/luizmeireles)\ **Replies:** 8\ **Last updated:** [July 15, 2024, 8:59pm UTC](https://discuss.elastic.co/t/threshold-security-rule/362464 "2024-07-15T20:59:50Z")
I am trying to create a Threshold rule-based .. if I have 1 or more events with login failure, create an alert, As you can see in the image, in the Rule preview, some alerts were "found", but this rule is not generat… --- ## [Rules not generating alerts after update from 8.12.2 to 8.14.2](https://discuss.elastic.co/t/rules-not-generating-alerts-after-update-from-8-12-2-to-8-14-2/362909)
**Author:** [@Vm\_Elastic](https://discuss.elastic.co/u/Vm_Elastic)\ **Replies:** 4\ **Last updated:** [July 11, 2024, 9:26pm UTC](https://discuss.elastic.co/t/rules-not-generating-alerts-after-update-from-8-12-2-to-8-14-2/362909 "2024-07-11T21:26:43Z")
Need help -: updated cluster from 8.12.2 to 8.14.2 and now after the update no alerts are being generated, also getting error messages like " there's been a catastrophic error trying to install index level resources for … --- ## [Log Storage Location - Elastic Defend Logs macOS](https://discuss.elastic.co/t/log-storage-location-elastic-defend-logs-macos/362904)
**Author:** [@marmai16](https://discuss.elastic.co/u/marmai16)\ **Replies:** 2\ **Last updated:** [July 10, 2024, 6:57pm UTC](https://discuss.elastic.co/t/log-storage-location-elastic-defend-logs-macos/362904 "2024-07-10T18:57:58Z")
Hello everyone, i'm currently playing around with the Elastic Defend component. I recently rolled it out to a macOS machine in order to gather process and file events. My question here is, where are these logs stored l… --- ## [Why do I need to install the elastic agent when syncing data from Azure Event Hubs to Elastic?](https://discuss.elastic.co/t/why-do-i-need-to-install-the-elastic-agent-when-syncing-data-from-azure-event-hubs-to-elastic/362853)
**Author:** [@CtrlCloud-Jelle](https://discuss.elastic.co/u/CtrlCloud-Jelle)\ **Replies:** 4\ **Last updated:** [July 10, 2024, 3:30pm UTC](https://discuss.elastic.co/t/why-do-i-need-to-install-the-elastic-agent-when-syncing-data-from-azure-event-hubs-to-elastic/362853 "2024-07-10T15:30:34Z")
I'm new to Elastic and the whole stack. I want to use Elastic as a SIEM solution, meaning I'll have to ingest data. I totally understand I need to install an agent locally for XDR/EDR or monitoring servers and sending l… --- ## [Publish data to Elastic SIEM](https://discuss.elastic.co/t/publish-data-to-elastic-siem/362685)
**Author:** [@sateeshkumarb](https://discuss.elastic.co/u/sateeshkumarb)\ **Replies:** 2\ **Last updated:** [July 8, 2024, 5:56pm UTC](https://discuss.elastic.co/t/publish-data-to-elastic-siem/362685 "2024-07-08T17:56:42Z")
Hi, I am trying to ingest some custom security event data (for which there is no Elastic integration) into Elastic SIEM. Looking at this chart: it seems only way to do so is via Elastic agent. However I can't install… --- ## [Trigering Alerts for Machine learning Jobs](https://discuss.elastic.co/t/trigering-alerts-for-machine-learning-jobs/361417)
**Author:** [@apa1](https://discuss.elastic.co/u/apa1)\ **Replies:** 2\ **Last updated:** [July 4, 2024, 3:01am UTC](https://discuss.elastic.co/t/trigering-alerts-for-machine-learning-jobs/361417 "2024-07-04T03:01:02Z")
Hi, I have created a Machine learning "Job" helping me identify anomalies in traffic for endpoints. Some endpoints are triggering a score range of 97, 98, 99 % . The job is started and runs. I have at the same time c… --- ## [Elastic Security Prebuilt Rules Error](https://discuss.elastic.co/t/elastic-security-prebuilt-rules-error/362135)
**Author:** [@spazzrabbit](https://discuss.elastic.co/u/spazzrabbit)\ **Replies:** 7\ **Last updated:** [July 2, 2024, 11:26am UTC](https://discuss.elastic.co/t/elastic-security-prebuilt-rules-error/362135 "2024-07-02T11:26:57Z")
Hello everyone, I am facing an issue with all prebuilt rules in Elasticsearch, when I enable the rules it runs with the following error. An error occurred during rule execution: message: "verification\_exception Root ca… --- ## [Elasticsearch 7.9.3 http 401](https://discuss.elastic.co/t/elasticsearch-7-9-3-http-401/362271)
**Author:** [@liqunlin](https://discuss.elastic.co/u/liqunlin)\ **Replies:** 0\ **Last updated:** [July 1, 2024, 6:30am UTC](https://discuss.elastic.co/t/elasticsearch-7-9-3-http-401/362271 "2024-07-01T06:30:08Z")
The production environment uses elasticsearch 7.9.3 and uses xpack authentication as basic auth,When we were doing a master-slave cluster switch drill, we found a large number of authentication exception logs http 401, T… --- ## [Elastic Endpoint cannot connect to agent](https://discuss.elastic.co/t/elastic-endpoint-cannot-connect-to-agent/362030)
**Author:** [@marcussjogren](https://discuss.elastic.co/u/marcussjogren)\ **Replies:** 5\ **Last updated:** [June 28, 2024, 12:22pm UTC](https://discuss.elastic.co/t/elastic-endpoint-cannot-connect-to-agent/362030 "2024-06-28T12:22:26Z")
Hi, I have enrolled Elastic Endpoint via Fleet, but I cannot seem to get it working and there is very little troubleshooting information available. I am receiving the below errors when the Endpoint is starting and I ca… --- ## [Cross cluster replication not able to start](https://discuss.elastic.co/t/cross-cluster-replication-not-able-to-start/362118)
**Author:** [@nikita\_sahu](https://discuss.elastic.co/u/nikita_sahu)\ **Replies:** 8\ **Last updated:** [June 28, 2024, 10:06am UTC](https://discuss.elastic.co/t/cross-cluster-replication-not-able-to-start/362118 "2024-06-28T10:06:19Z")
I am facing an issue and that is I have created a 'leader01' index on leader node and when I am going to replicate it in follower node under 'follower01' index then follower node is not able to find the 'leader01' index … --- ## [Pulling the list of Endpoints](https://discuss.elastic.co/t/pulling-the-list-of-endpoints/362134)
**Author:** [@Charles\_Nkuna](https://discuss.elastic.co/u/Charles_Nkuna)\ **Replies:** 0\ **Last updated:** [June 27, 2024, 5:57am UTC](https://discuss.elastic.co/t/pulling-the-list-of-endpoints/362134 "2024-06-27T05:57:08Z")
Hi, i want to pull the list of all agent including all the agent status not under fleet but on discover because i want to pull the list as csv. Any one know which query i can run to get what i mentioned? Thanks --- ## [Timeline Template Save Not Working](https://discuss.elastic.co/t/timeline-template-save-not-working/361877)
**Author:** [@j91321](https://discuss.elastic.co/u/j91321)\ **Replies:** 4\ **Last updated:** [June 25, 2024, 1:59pm UTC](https://discuss.elastic.co/t/timeline-template-save-not-working/361877 "2024-06-25T13:59:09Z")
When creating a new Timeline Template in Elastic Security I cannot save the timeline. I've been encountering this issue for several versions now, latest being 8.12.2. Clicking the Save button, the progress indicator jus… --- ## [How to ask Elastic Defend to use Logstash as output?](https://discuss.elastic.co/t/how-to-ask-elastic-defend-to-use-logstash-as-output/361922)
**Author:** [@kevinlin](https://discuss.elastic.co/u/kevinlin)\ **Replies:** 3\ **Last updated:** [June 25, 2024, 7:48am UTC](https://discuss.elastic.co/t/how-to-ask-elastic-defend-to-use-logstash-as-output/361922 "2024-06-25T07:48:38Z")
I have created: Fleet output (Name: OutLogstash, Type: Logstash, with Server SSL CA, Client SSL cert, Client SSL key) Fleet Agent policy (Name: WinAgentPolicy, Output for integrations: OutLogstash ) In WinAgentPolicy, … --- ## [Agent - Consume High memory](https://discuss.elastic.co/t/agent-consume-high-memory/361945)
**Author:** [@Charles\_Nkuna](https://discuss.elastic.co/u/Charles_Nkuna)\ **Replies:** 1\ **Last updated:** [June 24, 2024, 12:46pm UTC](https://discuss.elastic.co/t/agent-consume-high-memory/361945 "2024-06-24T12:46:23Z")
Hi, We installed elastic defend on our endpoints but the agent consume high CPU and machine becomes slow when running applications. W have put multiple exclusions in place but looks like its not fixing the issue. Any … --- ## [Elastic XDR - Removable Disk](https://discuss.elastic.co/t/elastic-xdr-removable-disk/361828)
**Author:** [@Charles\_Nkuna](https://discuss.elastic.co/u/Charles_Nkuna)\ **Replies:** 1\ **Last updated:** [June 21, 2024, 11:38am UTC](https://discuss.elastic.co/t/elastic-xdr-removable-disk/361828 "2024-06-21T11:38:58Z")
Hi, Does the Elastic XDR scan removable disk ? --- ## [Custom Indicators](https://discuss.elastic.co/t/custom-indicators/361688)
**Author:** [@digital-thought](https://discuss.elastic.co/u/digital-thought)\ **Replies:** 2\ **Last updated:** [June 20, 2024, 8:31am UTC](https://discuss.elastic.co/t/custom-indicators/361688 "2024-06-20T08:31:55Z")
It would be great to upload custom Indicators (IPs, file hashes, domains, etc) into the Threat Intelligence capabilities of Elasticsearch Security. I know I could index this material into Elastic using the REST API, how… --- ## [Elastic Watcher](https://discuss.elastic.co/t/elastic-watcher/361710)
**Author:** [@Charles\_Nkuna](https://discuss.elastic.co/u/Charles_Nkuna)\ **Replies:** 3\ **Last updated:** [June 19, 2024, 7:12pm UTC](https://discuss.elastic.co/t/elastic-watcher/361710 "2024-06-19T19:12:27Z")
Hi, Has anyone enabled the Watcher feature. Does it work accordingly ? is it possible to configure the agent status on it or its only around Cluster? Thanks --- ## [Integration of kibana dashboard and keycloack](https://discuss.elastic.co/t/integration-of-kibana-dashboard-and-keycloack/361754)
**Author:** [@Raalphie](https://discuss.elastic.co/u/Raalphie)\ **Replies:** 1\ **Last updated:** [June 19, 2024, 6:37pm UTC](https://discuss.elastic.co/t/integration-of-kibana-dashboard-and-keycloack/361754 "2024-06-19T18:37:37Z")
Hi need help setting up Keycloak OIDC with Kibana. --- ## [Versions of components used in elasticsearch:8.12.2 and 8.12.0](https://discuss.elastic.co/t/versions-of-components-used-in-elasticsearch-8-12-2-and-8-12-0/361695)
**Author:** [@inkumari](https://discuss.elastic.co/u/inkumari)\ **Replies:** 0\ **Last updated:** [June 19, 2024, 5:41am UTC](https://discuss.elastic.co/t/versions-of-components-used-in-elasticsearch-8-12-2-and-8-12-0/361695 "2024-06-19T05:41:40Z")
Hi. We are using two versions of elasticsearch in our setup in docker : 8.12.2 and 8.12.0. Due to security reasons, we need to know what are the versions of the following components used in both versions- blas giflib g… --- ## [Detect user login with different IP address](https://discuss.elastic.co/t/detect-user-login-with-different-ip-address/361633)
**Author:** [@Maeris](https://discuss.elastic.co/u/Maeris)\ **Replies:** 2\ **Last updated:** [June 18, 2024, 10:54am UTC](https://discuss.elastic.co/t/detect-user-login-with-different-ip-address/361633 "2024-06-18T10:54:23Z")
Hello, Im seeking to implement alerting for a scenario, where I want to detect if a user logs in from a previously not used IP address. My logs come in the following format: {"uuid":"7f8738fe72a2074a8f65f9587","create… --- ## [Elastic Alerts & Cases API](https://discuss.elastic.co/t/elastic-alerts-cases-api/361092)
**Author:** [@hal](https://discuss.elastic.co/u/hal)\ **Replies:** 2\ **Last updated:** [June 17, 2024, 6:45am UTC](https://discuss.elastic.co/t/elastic-alerts-cases-api/361092 "2024-06-17T06:45:41Z")
is there a way to add alerts to a case using api? I asked chatgpt and it gave me this: POST /api/cases/{case\_id}/alerts { "alerts": \[ { "id": "alert\_id\_1", "index": "index\_name\_1" }, { "id": "alert\_id\_2", "ind… --- ## [Centralized Case Management](https://discuss.elastic.co/t/centralized-case-management/361310)
**Author:** [@hal](https://discuss.elastic.co/u/hal)\ **Replies:** 0\ **Last updated:** [June 12, 2024, 9:11am UTC](https://discuss.elastic.co/t/centralized-case-management/361310 "2024-06-12T09:11:15Z")
Is there a way to manage cases for multiple customers in a centralized portal? --- ## [XDR not showing Prevent action/Denied](https://discuss.elastic.co/t/xdr-not-showing-prevent-action-denied/361212)
**Author:** [@Charles\_Nkuna](https://discuss.elastic.co/u/Charles_Nkuna)\ **Replies:** 1\ **Last updated:** [June 11, 2024, 8:34pm UTC](https://discuss.elastic.co/t/xdr-not-showing-prevent-action-denied/361212 "2024-06-11T20:34:36Z")
Hi, having a problem seeing events that are being denied/Prevented by Elastic Defend. I Have checked the policy and all set to prevent only seeing alerts that are being allowed/success not prevented and also the "notify… --- ## [Detecting inital of breach](https://discuss.elastic.co/t/detecting-inital-of-breach/361154)
**Author:** [@CHEETO](https://discuss.elastic.co/u/CHEETO)\ **Replies:** 1\ **Last updated:** [June 11, 2024, 12:31pm UTC](https://discuss.elastic.co/t/detecting-inital-of-breach/361154 "2024-06-11T12:31:40Z")
Hello, im currently working on a project where i have to find indicators of compromise and report to my supervisor. Im able to pin point when exactly event is happening but dont know how to figure out which IP address ar… --- ## [SIEM and XDR Alerts](https://discuss.elastic.co/t/siem-and-xdr-alerts/359963)
**Author:** [@Charles\_Nkuna](https://discuss.elastic.co/u/Charles_Nkuna)\ **Replies:** 8\ **Last updated:** [June 11, 2024, 5:12am UTC](https://discuss.elastic.co/t/siem-and-xdr-alerts/359963 "2024-06-11T05:12:23Z")
Hi, is possible to differentiate alert detections between SIEM and XDR on the console? --- ## [Ransomware protection](https://discuss.elastic.co/t/ransomware-protection/360948)
**Author:** [@Charles\_Nkuna](https://discuss.elastic.co/u/Charles_Nkuna)\ **Replies:** 6\ **Last updated:** [June 9, 2024, 8:15pm UTC](https://discuss.elastic.co/t/ransomware-protection/360948 "2024-06-09T20:15:10Z")
Hi What is "Anti-Ransomware Elastic-Do-Not-Touch" appearing on the folders machines --- ## [Delay in office logs](https://discuss.elastic.co/t/delay-in-office-logs/360513)
**Author:** [@mrosendo](https://discuss.elastic.co/u/mrosendo)\ **Replies:** 3\ **Last updated:** [June 8, 2024, 9:54pm UTC](https://discuss.elastic.co/t/delay-in-office-logs/360513 "2024-06-08T21:54:21Z")
Hi everyone, We just integrated Office 365 and we followed the steps describen in the integration. The API is showing that requests from Azure are ok, but the logs in Kibana comes like with 7 days of delay, so we don't … --- ## [Elastic AI Assistant Threshold Rule Fields kibana.alert.new\_terms](https://discuss.elastic.co/t/elastic-ai-assistant-threshold-rule-fields-kibana-alert-new-terms/360079)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 4\ **Last updated:** [June 6, 2024, 5:54pm UTC](https://discuss.elastic.co/t/elastic-ai-assistant-threshold-rule-fields-kibana-alert-new-terms/360079 "2024-06-06T17:54:04Z")
Hello, Question about adding alerts for threshold rules. Am I correct assuming that the field kibana.alert.new\_terms and it's value cannot be added to the alert data sent as context? Is there some way to always add… --- ## [Elastic-agent on Fedora Silverblue](https://discuss.elastic.co/t/elastic-agent-on-fedora-silverblue/360914)
**Author:** [@queried1](https://discuss.elastic.co/u/queried1)\ **Replies:** 3\ **Last updated:** [June 6, 2024, 2:11pm UTC](https://discuss.elastic.co/t/elastic-agent-on-fedora-silverblue/360914 "2024-06-06T14:11:02Z")
Hello! Has anyone got elastic-agent working on Fedora Silverblue or other immutable Linux OS? The problem is that elastic-agent wants to install its executable under /usr, but in Silverblue it is read-only. There is a … --- ## [How can you log GPRS data into elasticSearch, I am able to do this only Using Wi-Fi Modules](https://discuss.elastic.co/t/how-can-you-log-gprs-data-into-elasticsearch-i-am-able-to-do-this-only-using-wi-fi-modules/360924)
**Author:** [@YUMVUHORE\_Jean\_Bosco](https://discuss.elastic.co/u/YUMVUHORE_Jean_Bosco)\ **Replies:** 0\ **Last updated:** [June 6, 2024, 7:01am UTC](https://discuss.elastic.co/t/how-can-you-log-gprs-data-into-elasticsearch-i-am-able-to-do-this-only-using-wi-fi-modules/360924 "2024-06-06T07:01:22Z")
I am using SIM800L which use HTTP AT Commands to connect to the server [Previous page](https://discuss.elastic.co/c/security/83.md?page=12) [Next page](https://discuss.elastic.co/c/security/83.md?page=14)