# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=14 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 15 --- ## [Reference architecture for running Elastic SIEM on Kubernetes](https://discuss.elastic.co/t/reference-architecture-for-running-elastic-siem-on-kubernetes/360693)
**Author:** [@srini\_dk](https://discuss.elastic.co/u/srini_dk)\ **Replies:** 1\ **Last updated:** [June 3, 2024, 10:28pm UTC](https://discuss.elastic.co/t/reference-architecture-for-running-elastic-siem-on-kubernetes/360693 "2024-06-03T22:28:09Z")
Hi Team, Do we have any reference architecture for running Elastic SIEM on Kubernetes, on AWS or Azure? What services do we need to consider in terms of services, sizing, and network, and what pods should we include? R… --- ## [Response Action History Alerting](https://discuss.elastic.co/t/response-action-history-alerting/360519)
**Author:** [@Matthew\_Franz](https://discuss.elastic.co/u/Matthew_Franz)\ **Replies:** 1\ **Last updated:** [June 3, 2024, 6:44am UTC](https://discuss.elastic.co/t/response-action-history-alerting/360519 "2024-06-03T06:44:47Z")
I've opened up a case with Elastic Support but their first response didn't get it, so figured I'd try here as well. Other EDR like Falcon have pretty good audit logs you can create alerts on but I haven't yet found a wa… --- ## [Elasticsearch on-premise (docker) is not loading: "Can't reach this page"](https://discuss.elastic.co/t/elasticsearch-on-premise-docker-is-not-loading-cant-reach-this-page/360340)
**Author:** [@zbeedatm](https://discuss.elastic.co/u/zbeedatm)\ **Replies:** 4\ **Last updated:** [May 29, 2024, 1:29pm UTC](https://discuss.elastic.co/t/elasticsearch-on-premise-docker-is-not-loading-cant-reach-this-page/360340 "2024-05-29T13:29:06Z")
I'm trying to run elasticsearch locally, so I had installed docker then deployed elasticsearch image. But I'm getting" "Cannot reach this page" when loading it. (the docker itself is running, but the web interface is no… --- ## [Threshold confusion (detecting a burst of connections on a specific port)](https://discuss.elastic.co/t/threshold-confusion-detecting-a-burst-of-connections-on-a-specific-port/360246)
**Author:** [@beginthread](https://discuss.elastic.co/u/beginthread)\ **Replies:** 1\ **Last updated:** [May 29, 2024, 12:36pm UTC](https://discuss.elastic.co/t/threshold-confusion-detecting-a-burst-of-connections-on-a-specific-port/360246 "2024-05-29T12:36:58Z")
Hi Team! I am confused about threshold rules types, where I can't really understand the count and cardinality fields. I want to get an alert when a specific destination.port is frequently used (like a burst). Instead o… --- ## [Project1980](https://discuss.elastic.co/t/project1980/360338)
**Author:** [@Mike\_John](https://discuss.elastic.co/u/Mike_John)\ **Replies:** 1\ **Last updated:** [May 28, 2024, 9:25am UTC](https://discuss.elastic.co/t/project1980/360338 "2024-05-28T09:25:05Z")
java script node.js --- ## [Elastic Security with Enterprise License vs Elastic Security with free Basic](https://discuss.elastic.co/t/elastic-security-with-enterprise-license-vs-elastic-security-with-free-basic/359988)
**Author:** [@Aliya\_Khalel](https://discuss.elastic.co/u/Aliya_Khalel)\ **Replies:** 2\ **Last updated:** [May 27, 2024, 5:45am UTC](https://discuss.elastic.co/t/elastic-security-with-enterprise-license-vs-elastic-security-with-free-basic/359988 "2024-05-27T05:45:20Z")
We want to deploy Elastic SIEM and do know what to choose Enterprise or Free? What the difference in implementation or perfomance for Security? I read docs, they mention Machine Learning, External Alerting and searchab… --- ## [LSASS Memory Dump Handle Access & poqexec.exe?](https://discuss.elastic.co/t/lsass-memory-dump-handle-access-poqexec-exe/359194)
**Author:** [@GuruLee](https://discuss.elastic.co/u/GuruLee)\ **Replies:** 2\ **Last updated:** [May 23, 2024, 9:03pm UTC](https://discuss.elastic.co/t/lsass-memory-dump-handle-access-poqexec-exe/359194 "2024-05-23T21:03:57Z")
We are seeing Elastic security rule triggering alerts for LSASS Memory Dump Handle Access for the 'C:\\Windows\\System32\\poqexec.exe' process (Primitive Operations Queue Executor) on several endpoints with the computer acc… --- ## [Elastic XDR - Capabilities](https://discuss.elastic.co/t/elastic-xdr-capabilities/359875)
**Author:** [@Charles\_Nkuna](https://discuss.elastic.co/u/Charles_Nkuna)\ **Replies:** 2\ **Last updated:** [May 22, 2024, 7:32am UTC](https://discuss.elastic.co/t/elastic-xdr-capabilities/359875 "2024-05-22T07:32:04Z")
Elastic XDR – 1. Can you perform host scan on the Console? if so, how do you do that? 2. How do you read agent logs in terms of troubleshoot? 3. if the Agent is on Unhealthy status how do you troubleshoot the issue… --- ## [Alert triage enhancement ideas](https://discuss.elastic.co/t/alert-triage-enhancement-ideas/359602)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 3\ **Last updated:** [May 21, 2024, 8:52am UTC](https://discuss.elastic.co/t/alert-triage-enhancement-ideas/359602 "2024-05-21T08:52:56Z")
Hi everyone, We've been using the alert assignment functionality for a few months now, and it has been incredibly helpful. It really helps us keep track of who worked on what alert. However, we've noticed a couple of is… --- ## [Unhealthy agent status with failed policy status - agent 8.11.4](https://discuss.elastic.co/t/unhealthy-agent-status-with-failed-policy-status-agent-8-11-4/359569)
**Author:** [@elastic\_fan](https://discuss.elastic.co/u/elastic_fan)\ **Replies:** 2\ **Last updated:** [May 20, 2024, 6:23pm UTC](https://discuss.elastic.co/t/unhealthy-agent-status-with-failed-policy-status-agent-8-11-4/359569 "2024-05-20T18:23:47Z")
Hello, I have two Red Hat 8.8 machines that are reporting an Unhealthy agent status and a Failed policy status. Here are the unhealthy components with each component reporting similar messages "current state is disa… --- ## [Adding alers to cases in bulk](https://discuss.elastic.co/t/adding-alers-to-cases-in-bulk/359524)
**Author:** [@catn0b0t](https://discuss.elastic.co/u/catn0b0t)\ **Replies:** 1\ **Last updated:** [May 15, 2024, 3:20pm UTC](https://discuss.elastic.co/t/adding-alers-to-cases-in-bulk/359524 "2024-05-15T15:20:44Z")
Hi, I have some rules generating a lot of alerts (authentication alerts for example) and I noticed a small bug (I think) when adding these to a case. When I only select the alerts shown on the current page of the table, … --- ## [Impossible Travel Detection](https://discuss.elastic.co/t/impossible-travel-detection/359454)
**Author:** [@lfsdriver](https://discuss.elastic.co/u/lfsdriver)\ **Replies:** 0\ **Last updated:** [May 14, 2024, 11:38am UTC](https://discuss.elastic.co/t/impossible-travel-detection/359454 "2024-05-14T11:38:08Z")
Hi all, Just looking for a bit of advice regarding creating a transform job for detecting Impossible Travel Activity. We have had some success already however, it appears the Painless script is often using the wrong so… --- ## [\[Solved problem\] Endpoint security can not detect malware](https://discuss.elastic.co/t/solved-problem-endpoint-security-can-not-detect-malware/359090)
**Author:** [@Intruder](https://discuss.elastic.co/u/Intruder)\ **Replies:** 3\ **Last updated:** [May 14, 2024, 9:16am UTC](https://discuss.elastic.co/t/solved-problem-endpoint-security-can-not-detect-malware/359090 "2024-05-14T09:16:45Z")
Reboot the kibana and elasticsearch will do the trick after reconfigure the rules and policy. --- ## [USB or External device blocking on elastic-agent threat intel](https://discuss.elastic.co/t/usb-or-external-device-blocking-on-elastic-agent-threat-intel/359432)
**Author:** [@Rakiba](https://discuss.elastic.co/u/Rakiba)\ **Replies:** 0\ **Last updated:** [May 14, 2024, 7:25am UTC](https://discuss.elastic.co/t/usb-or-external-device-blocking-on-elastic-agent-threat-intel/359432 "2024-05-14T07:25:42Z")
Dear Concern, Is there any feature or integration for USB or external drive blocking in Elastic-Agent? Regards. --- ## [Agent unhealthy - Defend - failed install endpoint service - Exit status 213](https://discuss.elastic.co/t/agent-unhealthy-defend-failed-install-endpoint-service-exit-status-213/359198)
**Author:** [@W00glin](https://discuss.elastic.co/u/W00glin)\ **Replies:** 2\ **Last updated:** [May 13, 2024, 2:38pm UTC](https://discuss.elastic.co/t/agent-unhealthy-defend-failed-install-endpoint-service-exit-status-213/359198 "2024-05-13T14:38:07Z")
Hello, Running into this issue across a couple of agents we have in the fleet. Normally when I run into agent issues, I just uninstall and reinstall and the issues are removed. However this issue has been persistent acr… --- ## [Use OSQuery to compare against baseline](https://discuss.elastic.co/t/use-osquery-to-compare-against-baseline/359388)
**Author:** [@sourcreamnormanbates](https://discuss.elastic.co/u/sourcreamnormanbates)\ **Replies:** 0\ **Last updated:** [May 13, 2024, 2:13pm UTC](https://discuss.elastic.co/t/use-osquery-to-compare-against-baseline/359388 "2024-05-13T14:13:42Z")
Is there a way in OSQuery manager compare results against a baseline? My specific case is for incident response. I was to compare a list of processes on a compromised machine to a list of processes from a baseline mach… --- ## [Cross cluster search for SIEM rules](https://discuss.elastic.co/t/cross-cluster-search-for-siem-rules/359325)
**Author:** [@Aliya\_Khalel](https://discuss.elastic.co/u/Aliya_Khalel)\ **Replies:** 1\ **Last updated:** [May 12, 2024, 4:46pm UTC](https://discuss.elastic.co/t/cross-cluster-search-for-siem-rules/359325 "2024-05-12T16:46:57Z")
Hello I didn't find info in docs. So the question is, if I have remote cluster with Basic license where I store all logs and etc for SIEM and connect from remote cluster with Enteprise license and Kibana where I create… --- ## [Noisy rule](https://discuss.elastic.co/t/noisy-rule/358643)
**Author:** [@bbreer](https://discuss.elastic.co/u/bbreer)\ **Replies:** 1\ **Last updated:** [May 9, 2024, 2:15pm UTC](https://discuss.elastic.co/t/noisy-rule/358643 "2024-05-09T14:15:16Z")
We have some endpoint security applications that are triggering the built-in rule Suspicious Lsass Process Access. They are using Powershell to access the lsass process. I created a rule exception using the field proces… --- ## [Least-Privilege To View All Server Asset Sending Logs](https://discuss.elastic.co/t/least-privilege-to-view-all-server-asset-sending-logs/359107)
**Author:** [@Michael\_O\_Hara](https://discuss.elastic.co/u/Michael_O_Hara)\ **Replies:** 0\ **Last updated:** [May 8, 2024, 9:04pm UTC](https://discuss.elastic.co/t/least-privilege-to-view-all-server-asset-sending-logs/359107 "2024-05-08T21:04:09Z")
I was recently granted access into ELK but I cannot see any of the servers/assets that I was told were added & sending logs. What is the minimal RBAC I would need to see the servers & view what kind of volume they are … --- ## [Elastic defend is not working](https://discuss.elastic.co/t/elastic-defend-is-not-working/358737)
**Author:** [@Intruder](https://discuss.elastic.co/u/Intruder)\ **Replies:** 46\ **Last updated:** [May 8, 2024, 2:45pm UTC](https://discuss.elastic.co/t/elastic-defend-is-not-working/358737 "2024-05-08T14:45:14Z")
In the beginning , it works fine , BUT AFTER I changed the IP of the machine(which also disconnected the internet) , It starts unhealthy with this issue . I changed the yml file , and fleet server IP , but can no… --- ## [Look back time and maxspan in eql](https://discuss.elastic.co/t/look-back-time-and-maxspan-in-eql/358874)
**Author:** [@Esha](https://discuss.elastic.co/u/Esha)\ **Replies:** 1\ **Last updated:** [May 7, 2024, 1:24am UTC](https://discuss.elastic.co/t/look-back-time-and-maxspan-in-eql/358874 "2024-05-07T01:24:28Z")
Hi, Need some kind help. Do i need to schedule 1 hour look back time if im using maxspan=1hour to trace sequence of events in eql? Thank you --- ## [How to read an encrypted quarantine file?](https://discuss.elastic.co/t/how-to-read-an-encrypted-quarantine-file/358714)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 1\ **Last updated:** [May 3, 2024, 3:56pm UTC](https://discuss.elastic.co/t/how-to-read-an-encrypted-quarantine-file/358714 "2024-05-03T15:56:27Z")
Hello, there's a malware on an endpoint I manage, Elastic Defend put that malware in C:\\.equarantine\\xxxxxxxxxxxxxxxxxxxxxxx something like that. I went there and grabbed the file for analysis in my sandbox. It is an en… --- ## [Elastic Search Firewall Intergrations Issue](https://discuss.elastic.co/t/elastic-search-firewall-intergrations-issue/358480)
**Author:** [@Kamande\_John](https://discuss.elastic.co/u/Kamande_John)\ **Replies:** 3\ **Last updated:** [May 3, 2024, 7:19am UTC](https://discuss.elastic.co/t/elastic-search-firewall-intergrations-issue/358480 "2024-05-03T07:19:07Z")
Am having an issue with getting the elastic agent to start listening for Firewall (checkpoint & Cisco) syslog on a specific udp port. My setup is as follows: Linux server which has - Elastic Search, Kibana and Elastic … --- ## [AWS CSPM Integration](https://discuss.elastic.co/t/aws-cspm-integration/358453)
**Author:** [@eleong](https://discuss.elastic.co/u/eleong)\ **Replies:** 6\ **Last updated:** [May 2, 2024, 11:06pm UTC](https://discuss.elastic.co/t/aws-cspm-integration/358453 "2024-05-02T23:06:12Z")
Has anyone tried the CSPM function for AWS? I'm playing around with it but can't get the integration to work. There are some logs coming in from cloudbeat, but still no results in CSPM dashboard. Didn't want to touch t… --- ## [SIEM Detection Rules Alerts Actions](https://discuss.elastic.co/t/siem-detection-rules-alerts-actions/358039)
**Author:** [@Sunil\_Iyengar](https://discuss.elastic.co/u/Sunil_Iyengar)\ **Replies:** 2\ **Last updated:** [May 1, 2024, 4:15pm UTC](https://discuss.elastic.co/t/siem-detection-rules-alerts-actions/358039 "2024-05-01T16:15:33Z")
Hi All, Is there a way to create an default detection rule alert action endpoint and then have this for all detection rules alerts? i.e. bulk action all enabled rules to send the alerts to our notification endpoint? Che… --- ## [Deployment Architecture Scenarios Using ELK for SIEM at Large Scale on-promise](https://discuss.elastic.co/t/deployment-architecture-scenarios-using-elk-for-siem-at-large-scale-on-promise/358525)
**Author:** [@NasrJBr](https://discuss.elastic.co/u/NasrJBr)\ **Replies:** 5\ **Last updated:** [May 1, 2024, 3:49pm UTC](https://discuss.elastic.co/t/deployment-architecture-scenarios-using-elk-for-siem-at-large-scale-on-promise/358525 "2024-05-01T15:49:59Z")
i want to create some scenarios of deployment of ELK for SIEM usage in a large scale. any help/suggestions about this ? --- ## [Using user API to get built-in users](https://discuss.elastic.co/t/using-user-api-to-get-built-in-users/358556)
**Author:** [@ire](https://discuss.elastic.co/u/ire)\ **Replies:** 0\ **Last updated:** [May 1, 2024, 12:19pm UTC](https://discuss.elastic.co/t/using-user-api-to-get-built-in-users/358556 "2024-05-01T12:19:20Z")
Hello, I am hoping to get some help please. I have a version 7.17 Elasticsearch and using the dev tools, I run GET /\_security/user but I get { "error" : "Incorrect HTTP method for uri \[/\_security/user?pretty=true\] … --- ## [Share cases between spaces](https://discuss.elastic.co/t/share-cases-between-spaces/357244)
**Author:** [@Jorge\_Luis\_Sanchez\_C](https://discuss.elastic.co/u/Jorge_Luis_Sanchez_C)\ **Replies:** 0\ **Last updated:** [April 11, 2024, 9:15pm UTC](https://discuss.elastic.co/t/share-cases-between-spaces/357244 "2024-04-11T21:15:34Z")
Hello, in the Security\>Cases module, how can I share a case between different Spaces? --- ## [Machine learning rules : where to apply the high\_non\_zero\_count function](https://discuss.elastic.co/t/machine-learning-rules-where-to-apply-the-high-non-zero-count-function/358428)
**Author:** [@Poukim0m](https://discuss.elastic.co/u/Poukim0m)\ **Replies:** 0\ **Last updated:** [April 29, 2024, 1:18pm UTC](https://discuss.elastic.co/t/machine-learning-rules-where-to-apply-the-high-non-zero-count-function/358428 "2024-04-29T13:18:18Z")
hello, Do you know how to apply the high\_non\_zero\_count function (and others according to the documentation) during the creation of a new ML job? Kind regards Vivian --- ## [Log Stoppage Monitoring](https://discuss.elastic.co/t/log-stoppage-monitoring/358407)
**Author:** [@Phoenix1](https://discuss.elastic.co/u/Phoenix1)\ **Replies:** 0\ **Last updated:** [April 29, 2024, 9:15am UTC](https://discuss.elastic.co/t/log-stoppage-monitoring/358407 "2024-04-29T09:15:31Z")
How to create Log stoppage alert in Elasitc SIEM for any logsource/Index ? [Previous page](https://discuss.elastic.co/c/security/83.md?page=13) [Next page](https://discuss.elastic.co/c/security/83.md?page=15)