# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=15 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 16 --- ## [Elastic Endpoint failed](https://discuss.elastic.co/t/elastic-endpoint-failed/358366)
**Author:** [@mustafa.husny](https://discuss.elastic.co/u/mustafa.husny)\ **Replies:** 0\ **Last updated:** [April 28, 2024, 10:12am UTC](https://discuss.elastic.co/t/elastic-endpoint-failed/358366 "2024-04-28T10:12:32Z")
I am running elastic v8.13 on linux machine I am trying to monitor K8S cluster (SIEM - FIM and EDR) the agent is installed and I can get all nodes, then I added the system and FIM integration with no issues, the issue … --- ## [Problem with EQL sequence by with field containing reserved characters](https://discuss.elastic.co/t/problem-with-eql-sequence-by-with-field-containing-reserved-characters/358295)
**Author:** [@llafortezza](https://discuss.elastic.co/u/llafortezza)\ **Replies:** 4\ **Last updated:** [April 27, 2024, 12:16pm UTC](https://discuss.elastic.co/t/problem-with-eql-sequence-by-with-field-containing-reserved-characters/358295 "2024-04-27T12:16:59Z")
Hi, i have the following error line 1:56: mismatched input '.0' expecting {'with', '\[', '!\['} with this EQL query: sequence by azure.auditlogs.properties.target\_resources.0.id with maxspan=24h \[any where event.datas… --- ## [Azure CSPM - Multiple questions](https://discuss.elastic.co/t/azure-cspm-multiple-questions/355534)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 16\ **Last updated:** [April 25, 2024, 11:05am UTC](https://discuss.elastic.co/t/azure-cspm-multiple-questions/355534 "2024-04-25T11:05:05Z")
Hello, So I just enabled Azure CSPM (8.12.2) and I have some questions: Is there is a way to snooze / acknowledge / ignore findings? Some of the findings are not applicable to our organization and we would like to ig… --- ## [Machine Learning rule does not trigger while](https://discuss.elastic.co/t/machine-learning-rule-does-not-trigger-while/357147)
**Author:** [@Poukim0m](https://discuss.elastic.co/u/Poukim0m)\ **Replies:** 3\ **Last updated:** [April 24, 2024, 8:04am UTC](https://discuss.elastic.co/t/machine-learning-rule-does-not-trigger-while/357147 "2024-04-24T08:04:11Z")
Hello, i have created a machine learning job and i have selected this job in the correspondent machine learning rule in Security-\>Rules-\> Detection Rules and have added as action a notification to my e-mail. I have als… --- ## [Create Detection Rules via TF](https://discuss.elastic.co/t/create-detection-rules-via-tf/358040)
**Author:** [@Sunil\_Iyengar](https://discuss.elastic.co/u/Sunil_Iyengar)\ **Replies:** 0\ **Last updated:** [April 23, 2024, 3:11pm UTC](https://discuss.elastic.co/t/create-detection-rules-via-tf/358040 "2024-04-23T15:11:42Z")
Are there any examples of enabling and applying the default detection rules via terraform? Regards Sunil --- ## [Creating a User Watchlist](https://discuss.elastic.co/t/creating-a-user-watchlist/357161)
**Author:** [@vpolius](https://discuss.elastic.co/u/vpolius)\ **Replies:** 1\ **Last updated:** [April 22, 2024, 8:21pm UTC](https://discuss.elastic.co/t/creating-a-user-watchlist/357161 "2024-04-22T20:21:59Z")
Is it possible to create a user watchlist so I can keep track of any suspicious or anomalous behavior on a user's account? --- ## [System Virtual Process Detection Rule](https://discuss.elastic.co/t/system-virtual-process-detection-rule/356401)
**Author:** [@Brandon\_Duffy](https://discuss.elastic.co/u/Brandon_Duffy)\ **Replies:** 1\ **Last updated:** [April 19, 2024, 3:33pm UTC](https://discuss.elastic.co/t/system-virtual-process-detection-rule/356401 "2024-04-19T15:33:42Z")
Had a question about the rule "Unusual Child Process from a System Virtual Process", sorry if this is not the correct forum for it. I'm using the most recent rule query and when these alerts do spawn, we are unable to te… --- ## [Detection Rules on previous past element](https://discuss.elastic.co/t/detection-rules-on-previous-past-element/357772)
**Author:** [@Ragn](https://discuss.elastic.co/u/Ragn)\ **Replies:** 1\ **Last updated:** [April 19, 2024, 11:25am UTC](https://discuss.elastic.co/t/detection-rules-on-previous-past-element/357772 "2024-04-19T11:25:00Z")
Hello, I'm facing a problem with detection rules on a stack ELK. I need to upload events from past timestamp and check it with detection rules. For example, I will upload a ton of event that look like this: {"timesta… --- ## [Enrollent Token. Can we totally set to false permanently?](https://discuss.elastic.co/t/enrollent-token-can-we-totally-set-to-false-permanently/357686)
**Author:** [@Beyond\_Sky](https://discuss.elastic.co/u/Beyond_Sky)\ **Replies:** 0\ **Last updated:** [April 18, 2024, 9:27am UTC](https://discuss.elastic.co/t/enrollent-token-can-we-totally-set-to-false-permanently/357686 "2024-04-18T09:27:07Z")
Basically adding a new elasticsearch nodes, it require the adding of enrollment token and it is checked by ip address. Our certificates provided hostname but elasticsearch checks ip only. Is there a way to use hostname i… --- ## [Fleet Deploy OSQuery to Windows](https://discuss.elastic.co/t/fleet-deploy-osquery-to-windows/356301)
**Author:** [@sourcreamnormanbates](https://discuss.elastic.co/u/sourcreamnormanbates)\ **Replies:** 3\ **Last updated:** [April 17, 2024, 1:24pm UTC](https://discuss.elastic.co/t/fleet-deploy-osquery-to-windows/356301 "2024-04-17T13:24:35Z")
I have successfully deployed both OSQuery manager and one agent to a Linux machine. However; my deployment to a Windows box doesn't seem to be working. I believe it's because the log path needs to be modified to someth… --- ## [Sending the alert JSON details using Webhook Connector](https://discuss.elastic.co/t/sending-the-alert-json-details-using-webhook-connector/357223)
**Author:** [@aviran-cato](https://discuss.elastic.co/u/aviran-cato)\ **Replies:** 7\ **Last updated:** [April 11, 2024, 3:42pm UTC](https://discuss.elastic.co/t/sending-the-alert-json-details-using-webhook-connector/357223 "2024-04-11T15:42:06Z")
Hi, I want to use a Webhook connector to send the alert data to an automation platform. The issue is that in the Connector action, I can't find a way to send only the JSON alert information. As marked in the image. … --- ## [Notification from machine learning job per anomaly score](https://discuss.elastic.co/t/notification-from-machine-learning-job-per-anomaly-score/357148)
**Author:** [@Poukim0m](https://discuss.elastic.co/u/Poukim0m)\ **Replies:** 0\ **Last updated:** [April 10, 2024, 1:02pm UTC](https://discuss.elastic.co/t/notification-from-machine-learning-job-per-anomaly-score/357148 "2024-04-10T13:02:36Z")
Can I setup a notification mail at the level of a machine learning job depending on the anomaly score? For example I want to get notified when anomaly score \>=80 Thank you, Vivian --- ## [How do I adding Suricata events to Elasticsearch](https://discuss.elastic.co/t/how-do-i-adding-suricata-events-to-elasticsearch/356827)
**Author:** [@rayobe4014](https://discuss.elastic.co/u/rayobe4014)\ **Replies:** 7\ **Last updated:** [April 9, 2024, 5:26am UTC](https://discuss.elastic.co/t/how-do-i-adding-suricata-events-to-elasticsearch/356827 "2024-04-09T05:26:56Z")
I just configuration Exebox with Elasticsearch and Suricata but Elasticsearch not get event from Suricata so how can I add Suricata event to Elasticsearch ? Please guide me how to add Suricata event to Elasticsearch. … --- ## [Elastic pricing for on-premises deployment](https://discuss.elastic.co/t/elastic-pricing-for-on-premises-deployment/356980)
**Author:** [@S\_n\_Ngo\_Hoang](https://discuss.elastic.co/u/S_n_Ngo_Hoang)\ **Replies:** 5\ **Last updated:** [April 8, 2024, 4:26pm UTC](https://discuss.elastic.co/t/elastic-pricing-for-on-premises-deployment/356980 "2024-04-08T16:26:21Z")
Hello, I am currently working as a security analyst and am interested in Elastic and Machine Learning solutions. Currently I want to deploy Elastic Stack on-premises with 3 Elasticsearch nodes and 2 nodes for ML. I tried… --- ## [Can we bypass the Kibana authentication when we enable xpack secuirty 8.12](https://discuss.elastic.co/t/can-we-bypass-the-kibana-authentication-when-we-enable-xpack-secuirty-8-12/356962)
**Author:** [@D\_Talakola](https://discuss.elastic.co/u/D_Talakola)\ **Replies:** 0\ **Last updated:** [April 8, 2024, 11:26am UTC](https://discuss.elastic.co/t/can-we-bypass-the-kibana-authentication-when-we-enable-xpack-secuirty-8-12/356962 "2024-04-08T11:26:55Z")
Hi Team, Deployed Elasticsearch 8.12 by enabling xpack security with minimal security option on a k8s cluster. All the Elastic & Kibana pods up and when I tried to view the kibana page, it is asking for authentication(k… --- ## [Elastic Stack for SIEM(Elastic Security)](https://discuss.elastic.co/t/elastic-stack-for-siem-elastic-security/356870)
**Author:** [@Aliya\_Khalel](https://discuss.elastic.co/u/Aliya_Khalel)\ **Replies:** 1\ **Last updated:** [April 5, 2024, 2:19pm UTC](https://discuss.elastic.co/t/elastic-stack-for-siem-elastic-security/356870 "2024-04-05T14:19:42Z")
Hello, I am noob in Elastic. We planning to use Elastic Security for MSSP. 3 nodes of Elastic will be in private datacenter and our customer's logs will send by VPN. The question: I don't know how to forward data from… --- ## [Double escaping in expected due to windows events](https://discuss.elastic.co/t/double-escaping-in-expected-due-to-windows-events/356734)
**Author:** [@nahuel978](https://discuss.elastic.co/u/nahuel978)\ **Replies:** 4\ **Last updated:** [April 5, 2024, 1:56pm UTC](https://discuss.elastic.co/t/double-escaping-in-expected-due-to-windows-events/356734 "2024-04-05T13:56:03Z")
Hello everyone! I was studying the system/security decoder and I noticed that in the expected ones, the paths of records or files are with double backslashes. I understand that it is to escape the bar that already brings… --- ## [Elastic Agent - Ship Windows logs for SIEM](https://discuss.elastic.co/t/elastic-agent-ship-windows-logs-for-siem/356751)
**Author:** [@The\_BlueishSky](https://discuss.elastic.co/u/The_BlueishSky)\ **Replies:** 0\ **Last updated:** [April 4, 2024, 9:03am UTC](https://discuss.elastic.co/t/elastic-agent-ship-windows-logs-for-siem/356751 "2024-04-04T09:03:05Z")
We are in the process of deploying ELASTIC AGENT on all CLIENT OS , We intend to capture Windows Event logs more focused on Security Events which would be used for our SIEM. Any standard filters that can be applied and e… --- ## [Are Elasticsearch Security API authenticate responses the same for different logged-in users?](https://discuss.elastic.co/t/are-elasticsearch-security-api-authenticate-responses-the-same-for-different-logged-in-users/355376)
**Author:** [@bertugmete](https://discuss.elastic.co/u/bertugmete)\ **Replies:** 2\ **Last updated:** [April 3, 2024, 5:48pm UTC](https://discuss.elastic.co/t/are-elasticsearch-security-api-authenticate-responses-the-same-for-different-logged-in-users/355376 "2024-04-03T17:48:09Z")
My goal is to retrieve information about logged-in users, and for that, I'm using the Authenticate API | Elasticsearch Guide \[8.12\] | Elastic API. However, when I log in with different users, all values such as username,… --- ## [Set custom CA Certificate for Self Hosted Repository](https://discuss.elastic.co/t/set-custom-ca-certificate-for-self-hosted-repository/355199)
**Author:** [@jason4](https://discuss.elastic.co/u/jason4)\ **Replies:** 4\ **Last updated:** [April 3, 2024, 5:24pm UTC](https://discuss.elastic.co/t/set-custom-ca-certificate-for-self-hosted-repository/355199 "2024-04-03T17:24:27Z")
Hello, Is it possible to set a ca cert along with the advanced.artifacts.global.base\_url in the advanced settings for Elastic Defend, to be used when downloading from the security artifacts repository. Following the gui… --- ## [After the ElasticEndpoint enables full disk access, it is closed after a period of time](https://discuss.elastic.co/t/after-the-elasticendpoint-enables-full-disk-access-it-is-closed-after-a-period-of-time/354243)
**Author:** [@xqaiviwjxzw](https://discuss.elastic.co/u/xqaiviwjxzw)\ **Replies:** 10\ **Last updated:** [April 3, 2024, 2:01am UTC](https://discuss.elastic.co/t/after-the-elasticendpoint-enables-full-disk-access-it-is-closed-after-a-period-of-time/354243 "2024-04-03T02:01:25Z")
Elastic agent version: 8.9.1 Mac versions: 14.0, 14.1 Problem Description: After installing the Elatic Agent, full disk access was enabled, and the logs were all normal. However, after running for 1-2 days, the full d… --- ## [Elastic Endpoint 8.13.0 constantly crashing on Server 2022](https://discuss.elastic.co/t/elastic-endpoint-8-13-0-constantly-crashing-on-server-2022/356471)
**Author:** [@twilson](https://discuss.elastic.co/u/twilson)\ **Replies:** 11\ **Last updated:** [April 2, 2024, 4:49pm UTC](https://discuss.elastic.co/t/elastic-endpoint-8-13-0-constantly-crashing-on-server-2022/356471 "2024-04-02T16:49:59Z")
After upgrading from 8.12.1 to 8.13.0 the endpoint service on Windows Server 2022 machines is constantly crashing and restarting. This is not happening on Server 2016 or 2019 machines. The agent output is to elasticsea… --- ## [Sigma detection rules pipeline](https://discuss.elastic.co/t/sigma-detection-rules-pipeline/356381)
**Author:** [@maan](https://discuss.elastic.co/u/maan)\ **Replies:** 0\ **Last updated:** [March 28, 2024, 10:15am UTC](https://discuss.elastic.co/t/sigma-detection-rules-pipeline/356381 "2024-03-28T10:15:26Z")
Hi, Do anybody have a good pipeline to transform sigma(https://sigmahq.io/) detection rules to Elastic Security (Defend)? There where some resonable good examples for the old sigmac converter, but I haven't found any fo… --- ## [A variety of problems enabling security on elasticsearch](https://discuss.elastic.co/t/a-variety-of-problems-enabling-security-on-elasticsearch/356337)
**Author:** [@ire](https://discuss.elastic.co/u/ire)\ **Replies:** 2\ **Last updated:** [March 27, 2024, 8:47pm UTC](https://discuss.elastic.co/t/a-variety-of-problems-enabling-security-on-elasticsearch/356337 "2024-03-27T20:47:19Z")
I have a version 7.17 of elasticsearch in prod which I need to secure, I have provisioned a similar one with less nodes to test the process but after building some confidence in the process, I am stuck on getting the pro… --- ## [Sharing data accross spaces](https://discuss.elastic.co/t/sharing-data-accross-spaces/356335)
**Author:** [@David\_Self](https://discuss.elastic.co/u/David_Self)\ **Replies:** 0\ **Last updated:** [March 27, 2024, 8:16pm UTC](https://discuss.elastic.co/t/sharing-data-accross-spaces/356335 "2024-03-27T20:16:29Z")
when using the security module, data is saved in an index called .siem\_signals-"space name". Is there a way to share the index across spaces inside of the security module? I know you can make a data view in discovery but… --- ## [Integrate Microsoft Defender with Elastic](https://discuss.elastic.co/t/integrate-microsoft-defender-with-elastic/356079)
**Author:** [@rajith\_pathiraja](https://discuss.elastic.co/u/rajith_pathiraja)\ **Replies:** 2\ **Last updated:** [March 27, 2024, 12:44pm UTC](https://discuss.elastic.co/t/integrate-microsoft-defender-with-elastic/356079 "2024-03-27T12:44:01Z")
I have tried to integrate MS Defender with Elastic and unable to get the logs to elastic. I have followed the standard guideline given in Elastic documentation. Any one face the same issue ? --- ## [Multi-tenancy SIEM](https://discuss.elastic.co/t/multi-tenancy-siem/356108)
**Author:** [@infraendboss](https://discuss.elastic.co/u/infraendboss)\ **Replies:** 4\ **Last updated:** [March 26, 2024, 4:04pm UTC](https://discuss.elastic.co/t/multi-tenancy-siem/356108 "2024-03-26T16:04:31Z")
Hi all! For my research project, I have a problem. I want to set up a SIEM solution within the Elastic Cloud. In the SIEM solution, I aim to establish multi-tenancy for different customers, ensuring that each customer's… --- ## [Elastic webhook works sometimes and but sometimes fails](https://discuss.elastic.co/t/elastic-webhook-works-sometimes-and-but-sometimes-fails/356199)
**Author:** [@mmercaldi](https://discuss.elastic.co/u/mmercaldi)\ **Replies:** 0\ **Last updated:** [March 26, 2024, 5:51pm UTC](https://discuss.elastic.co/t/elastic-webhook-works-sometimes-and-but-sometimes-fails/356199 "2024-03-26T17:51:11Z")
So I am trying to use elastic to launch an ansible task using webhook if a certain syslog message is received In curl, the command that works is curl -s -k -u 'user:pass' -X POST -H 'Content-Type: application/json' -d… --- ## [Security Detection exception MATCHES not working properly](https://discuss.elastic.co/t/security-detection-exception-matches-not-working-properly/354621)
**Author:** [@stanley783](https://discuss.elastic.co/u/stanley783)\ **Replies:** 2\ **Last updated:** [March 26, 2024, 8:40am UTC](https://discuss.elastic.co/t/security-detection-exception-matches-not-working-properly/354621 "2024-03-26T08:40:05Z")
Hi, have this issue with exception. Have 2 parameters with IS operator, and one parameter with MATCHES. If I Edit that exception, do no changes, and then check "Close all alerts...", save, then all alerts are closed, so… --- ## [Response Console Upload "Action Fails" - failed to save file to disk or validate its integrity](https://discuss.elastic.co/t/response-console-upload-action-fails-failed-to-save-file-to-disk-or-validate-its-integrity/351734)
**Author:** [@pc\_it\_is](https://discuss.elastic.co/u/pc_it_is)\ **Replies:** 6\ **Last updated:** [March 16, 2024, 4:40pm UTC](https://discuss.elastic.co/t/response-console-upload-action-fails-failed-to-save-file-to-disk-or-validate-its-integrity/351734 "2024-03-16T16:40:44Z")
Elastic Security Endpoint: When uploading a file via "Response Console," a small "text" file upload succeeds, but upload of any sizeable file (8 MB PDF, 5 MB zip, 8 MB executable) all fail with " failed to saver file to … [Previous page](https://discuss.elastic.co/c/security/83.md?page=14) [Next page](https://discuss.elastic.co/c/security/83.md?page=16)