# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=17 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 18 --- ## [Is Elastic Endpoint Security Defender endgame?](https://discuss.elastic.co/t/is-elastic-endpoint-security-defender-endgame/352563)
**Author:** [@BigM1](https://discuss.elastic.co/u/BigM1)\ **Replies:** 1\ **Last updated:** [February 5, 2024, 8:16pm UTC](https://discuss.elastic.co/t/is-elastic-endpoint-security-defender-endgame/352563 "2024-02-05T20:16:20Z")
Quick questions Elasticians. With the acquisition of endgame, is Elastic Endpoint Security Defender == endgame ? Has the endgame capabilities been embedded into Elastic Endoint Defender ? --- ## [File Integrity Monitor Missing Events](https://discuss.elastic.co/t/file-integrity-monitor-missing-events/352141)
**Author:** [@wrsnrno](https://discuss.elastic.co/u/wrsnrno)\ **Replies:** 2\ **Last updated:** [February 3, 2024, 12:40pm UTC](https://discuss.elastic.co/t/file-integrity-monitor-missing-events/352141 "2024-02-03T12:40:19Z")
File Integrity Monitor missed several events in a recent planned software deployment. FIM is configured to track the application folder on a dozen nearly identical hosts and was first initialized about a month ago. Oth… --- ## [Detections API cant work with Unicode characters](https://discuss.elastic.co/t/detections-api-cant-work-with-unicode-characters/351781)
**Author:** [@gbL2k](https://discuss.elastic.co/u/gbL2k)\ **Replies:** 24\ **Last updated:** [January 26, 2024, 2:29pm UTC](https://discuss.elastic.co/t/detections-api-cant-work-with-unicode-characters/351781 "2024-01-26T14:29:10Z")
Hello everyone! I would like to to create detections with unicode characters in the description but I cant seem to find a way to make the API work with unicode characters. Anyone had the same problem? Thanks in advanc… --- ## [Rule preview is slow](https://discuss.elastic.co/t/rule-preview-is-slow/351732)
**Author:** [@elasticexpert](https://discuss.elastic.co/u/elasticexpert)\ **Replies:** 2\ **Last updated:** [January 25, 2024, 5:07am UTC](https://discuss.elastic.co/t/rule-preview-is-slow/351732 "2024-01-25T05:07:57Z")
Rule preview is very slow, but when I take the search and search it in kibana dev tools it is very fast. In the rule preview it says that the query time is fast (3ms), so I opened chrome dev tools at network and saw tha… --- ## [Script agent removal](https://discuss.elastic.co/t/script-agent-removal/351443)
**Author:** [@Nightingale\_John](https://discuss.elastic.co/u/Nightingale_John)\ **Replies:** 2\ **Last updated:** [January 19, 2024, 2:05pm UTC](https://discuss.elastic.co/t/script-agent-removal/351443 "2024-01-19T14:05:45Z")
Hi All, Hopefully this is a quick question for someone.. but I can't find any API to unenroll an agent from Elastic? I've tried a few methods but can't seem to make progress. Is anyone aware of anyway to script an agen… --- ## [Unable to enroll Elastic Agent to fleet running in the cloud](https://discuss.elastic.co/t/unable-to-enroll-elastic-agent-to-fleet-running-in-the-cloud/351394)
**Author:** [@vngcyber](https://discuss.elastic.co/u/vngcyber)\ **Replies:** 0\ **Last updated:** [January 19, 2024, 4:00am UTC](https://discuss.elastic.co/t/unable-to-enroll-elastic-agent-to-fleet-running-in-the-cloud/351394 "2024-01-19T04:00:53Z")
Getting the below error message when attempting to enroll an Elastic Agent to a Fleet running in Elastic Cloud. Please help! {"log.level":"info","@timestamp":"2024-01-18T22:51:26.027-0500","log.origin":{"file.name":"cmd… --- ## [Include a custom non-ECS field in alerts](https://discuss.elastic.co/t/include-a-custom-non-ecs-field-in-alerts/351280)
**Author:** [@jcruz](https://discuss.elastic.co/u/jcruz)\ **Replies:** 1\ **Last updated:** [January 17, 2024, 2:08pm UTC](https://discuss.elastic.co/t/include-a-custom-non-ecs-field-in-alerts/351280 "2024-01-17T14:08:15Z")
Hello guys! We have some indices with enriched custom fields that are not ECS compatible, as they are business related information. We would like to have those fields in the alerts generated from Detection-Rules, so we … --- ## [Elastic Detection Rules](https://discuss.elastic.co/t/elastic-detection-rules/351032)
**Author:** [@Ammar\_Mostafa](https://discuss.elastic.co/u/Ammar_Mostafa)\ **Replies:** 0\ **Last updated:** [January 14, 2024, 5:01pm UTC](https://discuss.elastic.co/t/elastic-detection-rules/351032 "2024-01-14T17:01:48Z")
I want to make a rule that trigger an alert when The Ids Generates certain alert. Let's assume I have an IDS rule says that when Facebook is accessed trigger an alert. I want to make a rule in siem also to Trigger to te… --- ## [Sizing Elastic Stack for a PoC (security use case)](https://discuss.elastic.co/t/sizing-elastic-stack-for-a-poc-security-use-case/350733)
**Author:** [@Ammar\_Mostafa](https://discuss.elastic.co/u/Ammar_Mostafa)\ **Replies:** 6\ **Last updated:** [January 14, 2024, 2:12pm UTC](https://discuss.elastic.co/t/sizing-elastic-stack-for-a-poc-security-use-case/350733 "2024-01-14T14:12:04Z")
Hello Everyone, I was asked to make a PoC to show the capability the Elastic as a SIEM so the PoC will take logs from (Fortigate Firewall, Two WIndows PCs, one Windows server for file sharing) So I will setup Elasticsea… --- ## [installing SIEM in ELK](https://discuss.elastic.co/t/installing-siem-in-elk/350008)
**Author:** [@Maksim\_Alchinov](https://discuss.elastic.co/u/Maksim_Alchinov)\ **Replies:** 1\ **Last updated:** [January 13, 2024, 9:55am UTC](https://discuss.elastic.co/t/installing-siem-in-elk/350008 "2024-01-13T09:55:14Z")
Hello, I have installed the EKL stack on my test stand, for further work and analysis of logs we need to install SIEM. How can this be done? How can I load correlation rules for log analysis? --- ## [Native SOAR in Elastic](https://discuss.elastic.co/t/native-soar-in-elastic/350977)
**Author:** [@blueoreo](https://discuss.elastic.co/u/blueoreo)\ **Replies:** 1\ **Last updated:** [January 12, 2024, 5:39pm UTC](https://discuss.elastic.co/t/native-soar-in-elastic/350977 "2024-01-12T17:39:24Z")
Hi Team, I wanted some help in clarifying the capabilities of Elastic Products. For native SOAR Capabilities, is it provided by Elastic Security? Additionally, what are the features of the native SOAR Platform? Thank… --- ## [Getting crazy with nnotes.dll](https://discuss.elastic.co/t/getting-crazy-with-nnotes-dll/349544)
**Author:** [@GKre](https://discuss.elastic.co/u/GKre)\ **Replies:** 8\ **Last updated:** [January 11, 2024, 3:41pm UTC](https://discuss.elastic.co/t/getting-crazy-with-nnotes-dll/349544 "2024-01-11T15:41:53Z")
Yes - i am using HCL Notes / Domino in release 12 and 14 (the newest one). Elastic Endpoint Security is driving me crazy as it is putting the file "nnotes.dll" into quartantain. I tested rule exception and endpoint exc… --- ## [Kibana security roles access control](https://discuss.elastic.co/t/kibana-security-roles-access-control/350614)
**Author:** [@mst3r25](https://discuss.elastic.co/u/mst3r25)\ **Replies:** 3\ **Last updated:** [January 10, 2024, 10:05pm UTC](https://discuss.elastic.co/t/kibana-security-roles-access-control/350614 "2024-01-10T22:05:41Z")
My ELK stack stop respecting roles and role mapping. Anyone with a vaild cert can access any Space or index even if they don'tt have that role assigned to them. I upgrade to version 8.11.2 from 8.8.1 last month, but I a … --- ## [Elastic Agents Sending Large Amounts of Data](https://discuss.elastic.co/t/elastic-agents-sending-large-amounts-of-data/350413)
**Author:** [@sourcreamnormanbates](https://discuss.elastic.co/u/sourcreamnormanbates)\ **Replies:** 5\ **Last updated:** [January 10, 2024, 3:37pm UTC](https://discuss.elastic.co/t/elastic-agents-sending-large-amounts-of-data/350413 "2024-01-10T15:37:34Z")
Some of my agents are sending 1GB of data every hour. They are all laptops and desktops with a basic setup. Would they do that if the elasticsearch destination they are sending data to is down? --- ## [Docker SIEM install](https://discuss.elastic.co/t/docker-siem-install/349661)
**Author:** [@Mike\_Kirby](https://discuss.elastic.co/u/Mike_Kirby)\ **Replies:** 1\ **Last updated:** [January 8, 2024, 2:14pm UTC](https://discuss.elastic.co/t/docker-siem-install/349661 "2024-01-08T14:14:35Z")
I am at the beginning of a new ELK SIEM installation and am looking to verify a couple of items. When creating the SIEM in docker the documentation does not say to pull the Logstash component. Is there a reason for th… --- ## [Siem integrated ml jobs and multi tenancy](https://discuss.elastic.co/t/siem-integrated-ml-jobs-and-multi-tenancy/350315)
**Author:** [@Crazyworlds](https://discuss.elastic.co/u/Crazyworlds)\ **Replies:** 2\ **Last updated:** [January 4, 2024, 8:31am UTC](https://discuss.elastic.co/t/siem-integrated-ml-jobs-and-multi-tenancy/350315 "2024-01-04T08:31:48Z")
Hi to everyone, We use the ECS field 'organization.name" and "data\_stream.namespace" to distinguish the organization name, and it work well with SIEM alert rules excluding those based on machine learning. On this king… --- ## [Elastic Security Rule Keyword issue](https://discuss.elastic.co/t/elastic-security-rule-keyword-issue/349782)
**Author:** [@DVD\_MNC](https://discuss.elastic.co/u/DVD_MNC)\ **Replies:** 1\ **Last updated:** [January 3, 2024, 2:13pm UTC](https://discuss.elastic.co/t/elastic-security-rule-keyword-issue/349782 "2024-01-03T14:13:56Z")
Hello everyone, I have a strange problem with elastic rules. As you can see from the rule, I'm trying to trigger an alert every time a user misses a login twice (it's just a test). The preview of the rule works only i… --- ## [Add filed to Elastic Agentedit](https://discuss.elastic.co/t/add-filed-to-elastic-agentedit/350139)
**Author:** [@Crazyworlds](https://discuss.elastic.co/u/Crazyworlds)\ **Replies:** 2\ **Last updated:** [January 3, 2024, 2:03pm UTC](https://discuss.elastic.co/t/add-filed-to-elastic-agentedit/350139 "2024-01-03T14:03:05Z")
I notice that Elastic Agent does not populate the ecs filed organization.name and for this, following the documentation I try to create a pipiline as this: POST /\_ingest/pipeline/\_simulate { "pipeline" : { "processo… --- ## [Help for Tracking Exception Rule Hits in Elastic Security](https://discuss.elastic.co/t/help-for-tracking-exception-rule-hits-in-elastic-security/350298)
**Author:** [@anak1n](https://discuss.elastic.co/u/anak1n)\ **Replies:** 0\ **Last updated:** [January 3, 2024, 11:22am UTC](https://discuss.elastic.co/t/help-for-tracking-exception-rule-hits-in-elastic-security/350298 "2024-01-03T11:22:43Z")
Hello Elastic Security Community, I'm currently working with Elastic Security and have implemented several exception rules to fine-tune my alert system. However, I've encountered a challenge: I need to measure the effec… --- ## [How much cpu power needed for elk consider security use case?](https://discuss.elastic.co/t/how-much-cpu-power-needed-for-elk-consider-security-use-case/350179)
**Author:** [@Ammar\_Mostafa](https://discuss.elastic.co/u/Ammar_Mostafa)\ **Replies:** 4\ **Last updated:** [January 2, 2024, 12:48pm UTC](https://discuss.elastic.co/t/how-much-cpu-power-needed-for-elk-consider-security-use-case/350179 "2024-01-02T12:48:27Z")
elk documentation say that for every 20 shard we need 1 gb ram what about cpu? --- ## [ElasticSearch affected by CVE-2023-44487](https://discuss.elastic.co/t/elasticsearch-affected-by-cve-2023-44487/350190)
**Author:** [@rairanjit](https://discuss.elastic.co/u/rairanjit)\ **Replies:** 0\ **Last updated:** [January 2, 2024, 4:16am UTC](https://discuss.elastic.co/t/elasticsearch-affected-by-cve-2023-44487/350190 "2024-01-02T04:16:42Z")
Elasticsearch 8.11.3 show that following file in respository-azure folder is affected by CVE-2023-44487. netty-codec-http2-4.1.94.Final.jar Is there a safe way I can remove this from docker images, so that modules load… --- ## [Sizing elk for SIEM(security) use case](https://discuss.elastic.co/t/sizing-elk-for-siem-security-use-case/350178)
**Author:** [@Ammar\_Mostafa](https://discuss.elastic.co/u/Ammar_Mostafa)\ **Replies:** 2\ **Last updated:** [January 1, 2024, 4:42pm UTC](https://discuss.elastic.co/t/sizing-elk-for-siem-security-use-case/350178 "2024-01-01T16:42:52Z")
Hello everyone, can you help me how to size my elk as SIEM? any thoughts or resources can help please give to me. Thanks in advance. --- ## [Machine Learning node Pricing](https://discuss.elastic.co/t/machine-learning-node-pricing/350113)
**Author:** [@haopv](https://discuss.elastic.co/u/haopv)\ **Replies:** 1\ **Last updated:** [December 29, 2023, 11:30am UTC](https://discuss.elastic.co/t/machine-learning-node-pricing/350113 "2023-12-29T11:30:59Z")
Hi Elastic, I have 20 nodes data Elastic in my Cluster on Premises with Basic License, Can I add 2 nodes machine learning for ML Job (Security Rule ML) and pay license for only 2 nodes ML ? If not! What is the way to o… --- ## [Integration with cisco ISE, PaloAlto and Fortigate Firewall](https://discuss.elastic.co/t/integration-with-cisco-ise-paloalto-and-fortigate-firewall/349848)
**Author:** [@Ganesh\_DV](https://discuss.elastic.co/u/Ganesh_DV)\ **Replies:** 15\ **Last updated:** [December 28, 2023, 3:08pm UTC](https://discuss.elastic.co/t/integration-with-cisco-ise-paloalto-and-fortigate-firewall/349848 "2023-12-28T15:08:46Z")
Hi team. im new to elasticsearch, kindly help me to resolve with below mentioned problem in integartion. I configured cisco ise, fortinet and paloalto firewalls to push logs to elasticsearch via Load balancer . Logs ar… --- ## [Elastic SIEM](https://discuss.elastic.co/t/elastic-siem/350026)
**Author:** [@Ammar\_Mostafa](https://discuss.elastic.co/u/Ammar_Mostafa)\ **Replies:** 0\ **Last updated:** [December 27, 2023, 2:54pm UTC](https://discuss.elastic.co/t/elastic-siem/350026 "2023-12-27T14:54:06Z")
Hello All, I hope all is well with you. I'm new to elastic and I want to inquire if we can fully depend on elastic security as siem solution? Thnk you in advance. --- ## [Kibana doesn't respond when I create Elastic AI Assistant](https://discuss.elastic.co/t/kibana-doesnt-respond-when-i-create-elastic-ai-assistant/349854)
**Author:** [@xjieup](https://discuss.elastic.co/u/xjieup)\ **Replies:** 0\ **Last updated:** [December 22, 2023, 11:25am UTC](https://discuss.elastic.co/t/kibana-doesnt-respond-when-i-create-elastic-ai-assistant/349854 "2023-12-22T11:25:27Z")
I am used Elasticsearch version 8.11.3. When I try to create an Elastic AI Assistant and click the Add Generative AI Connector button, Kibana gives an error "\[ERROR\]\[http\] 500 Server Error". Why? What can I try. --- ## [Determine the user that acknowledged an Alert](https://discuss.elastic.co/t/determine-the-user-that-acknowledged-an-alert/349426)
**Author:** [@lastshadow](https://discuss.elastic.co/u/lastshadow)\ **Replies:** 5\ **Last updated:** [December 21, 2023, 4:21pm UTC](https://discuss.elastic.co/t/determine-the-user-that-acknowledged-an-alert/349426 "2023-12-21T16:21:32Z")
I have several SOC analysts in my SIEM and need to figure out the following: How do I determine who acknowledged an alert? How can the analysts filter their acknowledged alerts so they only see what they have acknowled… --- ## [Recommended exceptions for Elastic Endpoint](https://discuss.elastic.co/t/recommended-exceptions-for-elastic-endpoint/349545)
**Author:** [@slash24](https://discuss.elastic.co/u/slash24)\ **Replies:** 2\ **Last updated:** [December 21, 2023, 2:53pm UTC](https://discuss.elastic.co/t/recommended-exceptions-for-elastic-endpoint/349545 "2023-12-21T14:53:26Z")
We've got elastic (8.8) defend on few hundreds windows-servers, but also rely on Windows Defender. Due to this, we want to make sure we exclude them from one another. From Windows Defender, what processes, folders or fi… --- ## [Alerts not working (stack version 8.2)](https://discuss.elastic.co/t/alerts-not-working-stack-version-8-2/349773)
**Author:** [@ooaleksiienko](https://discuss.elastic.co/u/ooaleksiienko)\ **Replies:** 0\ **Last updated:** [December 21, 2023, 8:32am UTC](https://discuss.elastic.co/t/alerts-not-working-stack-version-8-2/349773 "2023-12-21T08:32:46Z")
Problem with: Installing namespace-level resources and creating concrete index for .alerts-security.alerts-default when restarting Kibana I've checked and can see that after fleet setup next Component Templates downlo… --- ## [Elastic Endpoint Restarted](https://discuss.elastic.co/t/elastic-endpoint-restarted/349375)
**Author:** [@sourcreamnormanbates](https://discuss.elastic.co/u/sourcreamnormanbates)\ **Replies:** 2\ **Last updated:** [December 20, 2023, 2:51pm UTC](https://discuss.elastic.co/t/elastic-endpoint-restarted/349375 "2023-12-20T14:51:36Z")
I'm trying to understand what happened recently where this command ran on a desktop "sc.exe start ElasticEndpoint restarted" We also use SentinelOne, and SentinelOne detected that activity as malicious, so I'm trying to… [Previous page](https://discuss.elastic.co/c/security/83.md?page=16) [Next page](https://discuss.elastic.co/c/security/83.md?page=18)