# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=16 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 17 --- ## [Elastic defend integration error](https://discuss.elastic.co/t/elastic-defend-integration-error/355393)
**Author:** [@maslan](https://discuss.elastic.co/u/maslan)\ **Replies:** 2\ **Last updated:** [March 14, 2024, 2:36pm UTC](https://discuss.elastic.co/t/elastic-defend-integration-error/355393 "2024-03-14T14:36:59Z")
\[elastic\_agent.endpoint\_security\]\[warning\] error talking to the kernel (rtnetlink\_send) \[elastic\_agent.endpoint\_security\]\[warning\] rtnetlink replied: No such file or directory \[elastic\_agent.endpoint\_security\]\[error\] M… --- ## [Elastic Security Rule Exceptions vs Endpoint Exceptions](https://discuss.elastic.co/t/elastic-security-rule-exceptions-vs-endpoint-exceptions/355404)
**Author:** [@isa\_slngr](https://discuss.elastic.co/u/isa_slngr)\ **Replies:** 1\ **Last updated:** [March 14, 2024, 1:43pm UTC](https://discuss.elastic.co/t/elastic-security-rule-exceptions-vs-endpoint-exceptions/355404 "2024-03-14T13:43:06Z")
Good day, I was wondering is anyone could point me to documentation that details the difference between Rule Exceptions and Endpoint Exceptions in Elastic Security, including when to use which type of exception. --- ## [Investigate in timeline, extra wrong results](https://discuss.elastic.co/t/investigate-in-timeline-extra-wrong-results/354926)
**Author:** [@elasticexpert](https://discuss.elastic.co/u/elasticexpert)\ **Replies:** 3\ **Last updated:** [March 14, 2024, 6:54am UTC](https://discuss.elastic.co/t/investigate-in-timeline-extra-wrong-results/354926 "2024-03-14T06:54:43Z")
Hey! (Elasticsearch 8.11.1) I noticed that when I go to investigate in timeline on an alert, I get results that not match the timeline template search. For example, for the search of timeline template that looks like … --- ## [Elastic Search not work with evebox](https://discuss.elastic.co/t/elastic-search-not-work-with-evebox/355353)
**Author:** [@jed](https://discuss.elastic.co/u/jed)\ **Replies:** 5\ **Last updated:** [March 14, 2024, 3:47am UTC](https://discuss.elastic.co/t/elastic-search-not-work-with-evebox/355353 "2024-03-14T03:47:17Z")
I just create Elastic on Debain server and and connect with Evebox to get logs from suricata but it not work. here is my configuration Elasticsearch # Use a descriptive name for your cluster: # cluster.name: suricata # … --- ## [Kibana cookies contain “–” characters in the SID which causes the user requests to get blocked in the azure WAF](https://discuss.elastic.co/t/kibana-cookies-contain-characters-in-the-sid-which-causes-the-user-requests-to-get-blocked-in-the-azure-waf/355263)
**Author:** [@Jayasree\_N](https://discuss.elastic.co/u/Jayasree_N)\ **Replies:** 0\ **Last updated:** [March 12, 2024, 9:53pm UTC](https://discuss.elastic.co/t/kibana-cookies-contain-characters-in-the-sid-which-causes-the-user-requests-to-get-blocked-in-the-azure-waf/355263 "2024-03-12T21:53:10Z")
Hi, We are facing issue while using kibana using with URL, Whenever the user log-in to kibana with the RBAs user creds the user gets 403 error from the kibana servers. As we debugged the issue we came to know that the … --- ## [Okta SSO Elastic Cloud console](https://discuss.elastic.co/t/okta-sso-elastic-cloud-console/355255)
**Author:** [@Grbto](https://discuss.elastic.co/u/Grbto)\ **Replies:** 0\ **Last updated:** [March 12, 2024, 5:57pm UTC](https://discuss.elastic.co/t/okta-sso-elastic-cloud-console/355255 "2024-03-12T17:57:49Z")
I would like to know if it is possible to use Okta to SSO the Elastic cloud console where I manage all the deployments instead of creating one SSO for each deployment, My intention is to use Okta to login to the https:/… --- ## ["Toggle column in table" does nothing in Case table](https://discuss.elastic.co/t/toggle-column-in-table-does-nothing-in-case-table/355133)
**Author:** [@elasticexpert](https://discuss.elastic.co/u/elasticexpert)\ **Replies:** 0\ **Last updated:** [March 11, 2024, 8:31am UTC](https://discuss.elastic.co/t/toggle-column-in-table-does-nothing-in-case-table/355133 "2024-03-11T08:31:04Z")
elasticsearch 8.11.1 "Toggle column in table" inside a case does not add the column to the table --- ## [Endpoint Security not starting. "Windows can not verify the digital signature"](https://discuss.elastic.co/t/endpoint-security-not-starting-windows-can-not-verify-the-digital-signature/355034)
**Author:** [@gyterpena](https://discuss.elastic.co/u/gyterpena)\ **Replies:** 1\ **Last updated:** [March 8, 2024, 10:24pm UTC](https://discuss.elastic.co/t/endpoint-security-not-starting-windows-can-not-verify-the-digital-signature/355034 "2024-03-08T22:24:18Z")
Hello We recently deployed elastic-agent with defend policy to windows servers and on some older ones 2012R2 we have following error. This is with agent 8.12.2 Checking status of elastic-agent.exe PS C:\\Program Files\\… --- ## [Webhook - Case Management connector JSON payload from case object variables](https://discuss.elastic.co/t/webhook-case-management-connector-json-payload-from-case-object-variables/355060)
**Author:** [@aperez900907](https://discuss.elastic.co/u/aperez900907)\ **Replies:** 0\ **Last updated:** [March 8, 2024, 6:51pm UTC](https://discuss.elastic.co/t/webhook-case-management-connector-json-payload-from-case-object-variables/355060 "2024-03-08T18:51:16Z")
Is it possible to pass a richer context to an External incident management system by object variables? currently, the documentation only explains the following: { "fields": { "summary": {{{case.title}}}, "descri… --- ## [Unable to suppress duplicate alerts](https://discuss.elastic.co/t/unable-to-suppress-duplicate-alerts/354485)
**Author:** [@KraLot](https://discuss.elastic.co/u/KraLot)\ **Replies:** 4\ **Last updated:** [March 7, 2024, 4:59pm UTC](https://discuss.elastic.co/t/unable-to-suppress-duplicate-alerts/354485 "2024-03-07T16:59:02Z")
I am trying to build a rule to detect login activity from multiple countries (min 2 unique) within last 8 hours for a user and when matched alert should generate in 5mins. Run every: 5mins Additional Look-back: 8 hours … --- ## [Blocking Removable Media with Elastic Agent](https://discuss.elastic.co/t/blocking-removable-media-with-elastic-agent/354865)
**Author:** [@Patrick.kirk](https://discuss.elastic.co/u/Patrick.kirk)\ **Replies:** 1\ **Last updated:** [March 6, 2024, 5:55pm UTC](https://discuss.elastic.co/t/blocking-removable-media-with-elastic-agent/354865 "2024-03-06T17:55:47Z")
I know it was on Elastic's radar, but has there been any update in having Elastic Agent block removable media/usb's? --- ## [Response Action](https://discuss.elastic.co/t/response-action/354614)
**Author:** [@mohd\_sa](https://discuss.elastic.co/u/mohd_sa)\ **Replies:** 3\ **Last updated:** [March 5, 2024, 11:04am UTC](https://discuss.elastic.co/t/response-action/354614 "2024-03-05T11:04:30Z")
Hi when I send action query for example "processes" on response tab, i recieve this error "response action signature verification failed with error: signature could not be verified" --- ## [Kibana in K8 failed create token in http](https://discuss.elastic.co/t/kibana-in-k8-failed-create-token-in-http/354411)
**Author:** [@robbyq92](https://discuss.elastic.co/u/robbyq92)\ **Replies:** 1\ **Last updated:** [February 29, 2024, 9:59am UTC](https://discuss.elastic.co/t/kibana-in-k8-failed-create-token-in-http/354411 "2024-02-29T09:59:39Z")
Hi i have problem with my kibana in k8, i deploy one k8 with helm and i put elasticsearch in http (i have one ingress so i havent problem for https) and now i try to connect (deploy kibana) with helm but i have this: … --- ## [Orchestrate Elastic SIEM for training labs](https://discuss.elastic.co/t/orchestrate-elastic-siem-for-training-labs/353607)
**Author:** [@lastshadow](https://discuss.elastic.co/u/lastshadow)\ **Replies:** 2\ **Last updated:** [February 28, 2024, 6:22pm UTC](https://discuss.elastic.co/t/orchestrate-elastic-siem-for-training-labs/353607 "2024-02-28T18:22:28Z")
I have a cybersecurity training program that I teach. Currently I teach it live and I use Elastic SIEM. I think it is a great product and not just because of the cost. I deploy Elastic on docker and have it running for t… --- ## [Shiiping audit logs for DB with no connector available in Integrations](https://discuss.elastic.co/t/shiiping-audit-logs-for-db-with-no-connector-available-in-integrations/354232)
**Author:** [@Nouman\_Ahmed](https://discuss.elastic.co/u/Nouman_Ahmed)\ **Replies:** 4\ **Last updated:** [February 28, 2024, 2:58pm UTC](https://discuss.elastic.co/t/shiiping-audit-logs-for-db-with-no-connector-available-in-integrations/354232 "2024-02-28T14:58:53Z")
I have question why there are no connectors available for DBs like mongoDB, SQLite etc to capture audit logs while they are availble for SQL server, mysql?? and if there is no connector avaible to capture audit logs of m… --- ## [Large number of Agent errors/missing data](https://discuss.elastic.co/t/large-number-of-agent-errors-missing-data/354124)
**Author:** [@gyterpena](https://discuss.elastic.co/u/gyterpena)\ **Replies:** 2\ **Last updated:** [February 28, 2024, 7:56am UTC](https://discuss.elastic.co/t/large-number-of-agent-errors-missing-data/354124 "2024-02-28T07:56:02Z")
Hello We have elastic agent with security policy(elastic defend) enabled and configured. When testing I can see that test file(EICAR) is detected by agent, but no alert shows in Kibana. I can see alert logged to syslog,… --- ## [Elastic Defend integration: Is there a way to identify if an alert is caused due to prevention or detection?](https://discuss.elastic.co/t/elastic-defend-integration-is-there-a-way-to-identify-if-an-alert-is-caused-due-to-prevention-or-detection/354179)
**Author:** [@Krishna\_Teja](https://discuss.elastic.co/u/Krishna_Teja)\ **Replies:** 2\ **Last updated:** [February 27, 2024, 5:19pm UTC](https://discuss.elastic.co/t/elastic-defend-integration-is-there-a-way-to-identify-if-an-alert-is-caused-due-to-prevention-or-detection/354179 "2024-02-27T17:19:07Z")
Hi I'm using Endpoint Defend integration on a few agents. I want to know if an alert created was due to detection or prevention so I can trigger actions based on the status. Is there a way to identify the same? Also, c… --- ## [Okta certificate revokation](https://discuss.elastic.co/t/okta-certificate-revokation/354177)
**Author:** [@ursyathi](https://discuss.elastic.co/u/ursyathi)\ **Replies:** 0\ **Last updated:** [February 27, 2024, 6:33am UTC](https://discuss.elastic.co/t/okta-certificate-revokation/354177 "2024-02-27T06:33:49Z")
I am using Okta for SAML sign-on. I need to change the default self-signed certificate of Okta and use a certificate signed by third party. I need this because I need to revoke Okta certificate and check the OCSP flow in… --- ## [Correlation Query for spam email - not working](https://discuss.elastic.co/t/correlation-query-for-spam-email-not-working/354175)
**Author:** [@hamidijaz](https://discuss.elastic.co/u/hamidijaz)\ **Replies:** 0\ **Last updated:** [February 27, 2024, 4:55am UTC](https://discuss.elastic.co/t/correlation-query-for-spam-email-not-working/354175 "2024-02-27T04:55:55Z")
Hi, I have created a correlation rule with the following query, that runs every 5 mins. This is to detect if any external email address sends multiple emails to our internal email within given time (an hour), then it sh… --- ## [When creating a schedule snooze for elastic rules does it snooze based on the schedule or avoids snoozing during the schedule set?](https://discuss.elastic.co/t/when-creating-a-schedule-snooze-for-elastic-rules-does-it-snooze-based-on-the-schedule-or-avoids-snoozing-during-the-schedule-set/354018)
**Author:** [@Mike.exe](https://discuss.elastic.co/u/Mike.exe)\ **Replies:** 1\ **Last updated:** [February 23, 2024, 7:23pm UTC](https://discuss.elastic.co/t/when-creating-a-schedule-snooze-for-elastic-rules-does-it-snooze-based-on-the-schedule-or-avoids-snoozing-during-the-schedule-set/354018 "2024-02-23T19:23:52Z")
When creating a schedule snooze for elastic rules does it snooze based on the schedule or avoids snoozing during the schedule set? --- ## [Modify ID of an installed agent](https://discuss.elastic.co/t/modify-id-of-an-installed-agent/353991)
**Author:** [@Amanda\_Riverol\_Quesa](https://discuss.elastic.co/u/Amanda_Riverol_Quesa)\ **Replies:** 1\ **Last updated:** [February 23, 2024, 3:02pm UTC](https://discuss.elastic.co/t/modify-id-of-an-installed-agent/353991 "2024-02-23T15:02:29Z")
\*Good afternoon! I wanted to know if it is possible to change the ID of an agent once installed, the problem it would be presenting is that when cloning a VM the agent remains installed and with the ID the base machine,… --- ## [Security Elasticsearch version 8.12](https://discuss.elastic.co/t/security-elasticsearch-version-8-12/353387)
**Author:** [@sossoulokoariel](https://discuss.elastic.co/u/sossoulokoariel)\ **Replies:** 1\ **Last updated:** [February 22, 2024, 5:20pm UTC](https://discuss.elastic.co/t/security-elasticsearch-version-8-12/353387 "2024-02-22T17:20:46Z")
Hi community. I'm trying to configure the elasticsearch security to have a login page before accessing the resource but I can't get it. After deploying version 8, I go to the elasticsearch bin file to create a password b… --- ## [Threat Intel | Alien Vault](https://discuss.elastic.co/t/threat-intel-alien-vault/353205)
**Author:** [@Jordan\_Santander](https://discuss.elastic.co/u/Jordan_Santander)\ **Replies:** 2\ **Last updated:** [February 22, 2024, 3:45pm UTC](https://discuss.elastic.co/t/threat-intel-alien-vault/353205 "2024-02-22T15:45:47Z")
Hello everobody I need to know if the objects brought to elastic through the alien vault feed are deleted if I unsubscribe from the corresponding pulse. If not, do you know of a method to remove IoC? Thanks --- ## [Import / update value list (items) via api](https://discuss.elastic.co/t/import-update-value-list-items-via-api/353770)
**Author:** [@maan](https://discuss.elastic.co/u/maan)\ **Replies:** 4\ **Last updated:** [February 21, 2024, 2:21pm UTC](https://discuss.elastic.co/t/import-update-value-list-items-via-api/353770 "2024-02-21T14:21:08Z")
Using the lists api you can easily import items to a list. Now consider this imported source list have been updated and I want to reflect that in elastic. I would love it if I could just simple re-import it with some ki… --- ## [Timeline Error - a.reduce is not a function](https://discuss.elastic.co/t/timeline-error-a-reduce-is-not-a-function/353704)
**Author:** [@cristianhb](https://discuss.elastic.co/u/cristianhb)\ **Replies:** 3\ **Last updated:** [February 20, 2024, 4:52pm UTC](https://discuss.elastic.co/t/timeline-error-a-reduce-is-not-a-function/353704 "2024-02-20T16:52:53Z")
Hello, We have a fairly simple cluster which has everything in working order. However, the Timeline part does not work for some alerts. There is no correlation we can see between the alerts that this works for and the … --- ## [Can not create certificates for elasticsearch](https://discuss.elastic.co/t/can-not-create-certificates-for-elasticsearch/353509)
**Author:** [@Yerbolat\_Talasbekov](https://discuss.elastic.co/u/Yerbolat_Talasbekov)\ **Replies:** 7\ **Last updated:** [February 18, 2024, 2:39pm UTC](https://discuss.elastic.co/t/can-not-create-certificates-for-elasticsearch/353509 "2024-02-18T14:39:48Z")
Hello, can somebody help me with certificate creation? Here is my screens --- ## [Combine data views in Timeline Template](https://discuss.elastic.co/t/combine-data-views-in-timeline-template/353515)
**Author:** [@RoeeKent](https://discuss.elastic.co/u/RoeeKent)\ **Replies:** 1\ **Last updated:** [February 18, 2024, 1:42pm UTC](https://discuss.elastic.co/t/combine-data-views-in-timeline-template/353515 "2024-02-18T13:42:09Z")
Hi Everyone! I'm implementing the usage of timeline templates in my organization, but when I need to use different indices at the same time, I can't because it is based on data views and not on index patterns. I have so… --- ## [Elastic-endpoint installed although defend integration is not applied to policy](https://discuss.elastic.co/t/elastic-endpoint-installed-although-defend-integration-is-not-applied-to-policy/352632)
**Author:** [@Pinpin](https://discuss.elastic.co/u/Pinpin)\ **Replies:** 4\ **Last updated:** [February 8, 2024, 3:05pm UTC](https://discuss.elastic.co/t/elastic-endpoint-installed-although-defend-integration-is-not-applied-to-policy/352632 "2024-02-08T15:05:01Z")
Hi ! I'm kind of new to the whole elastic stack and I was tasked to put in place some sort of log monitoring and siem solution. After deploying the stack on some test hosts, everything was fine so I deployed the agent o… --- ## [Timeline Template see fields other then the fields in the alert](https://discuss.elastic.co/t/timeline-template-see-fields-other-then-the-fields-in-the-alert/352756)
**Author:** [@RoeeKent](https://discuss.elastic.co/u/RoeeKent)\ **Replies:** 4\ **Last updated:** [February 8, 2024, 12:23pm UTC](https://discuss.elastic.co/t/timeline-template-see-fields-other-then-the-fields-in-the-alert/352756 "2024-02-08T12:23:34Z")
Hi everyone! I would love to know if it is possible to add a timeline template to a detection rule, and use the fields in the template to see logs that are not part of the alert. For example, I have a rule that alerts … --- ## [Hide Show Timeline at bottom](https://discuss.elastic.co/t/hide-show-timeline-at-bottom/352565)
**Author:** [@sourcreamnormanbates](https://discuss.elastic.co/u/sourcreamnormanbates)\ **Replies:** 3\ **Last updated:** [February 5, 2024, 8:32pm UTC](https://discuss.elastic.co/t/hide-show-timeline-at-bottom/352565 "2024-02-05T20:32:53Z")
Is there a way to hide/show the timeline at the bottom of the page? It often makes navigation cumbersome when it is not being used such as reviewing long lists of alerts. You have to scroll all the way the bottom of th… [Previous page](https://discuss.elastic.co/c/security/83.md?page=15) [Next page](https://discuss.elastic.co/c/security/83.md?page=17)