# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=18 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 19 --- ## [Rules failing](https://discuss.elastic.co/t/rules-failing/349470)
**Author:** [@bbreer](https://discuss.elastic.co/u/bbreer)\ **Replies:** 2\ **Last updated:** [December 18, 2023, 7:25pm UTC](https://discuss.elastic.co/t/rules-failing/349470 "2023-12-18T19:25:17Z")
Hi, I have several rules that come back as Failed after running. I'm getting the following error for many rules. The field names for the unknown column message varies among the different rules. An error occurred during… --- ## [Unable to observe Security alerts in Elastic Security](https://discuss.elastic.co/t/unable-to-observe-security-alerts-in-elastic-security/349502)
**Author:** [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\ **Replies:** 1\ **Last updated:** [December 18, 2023, 5:22am UTC](https://discuss.elastic.co/t/unable-to-observe-security-alerts-in-elastic-security/349502 "2023-12-18T05:22:41Z")
Dear Team, I have setup a test environment on elastic cloud and i am ingesting windows events. I created an index with below mapping PUT alerts-security { "settings" : { "number\_of\_shards" : 1 }, "mappings" : { … --- ## [After upgrading macos to 14.x, the ElasticEndpoint authorization is automatically closed by the FDA](https://discuss.elastic.co/t/after-upgrading-macos-to-14-x-the-elasticendpoint-authorization-is-automatically-closed-by-the-fda/349328)
**Author:** [@xqaiviwjxzw](https://discuss.elastic.co/u/xqaiviwjxzw)\ **Replies:** 0\ **Last updated:** [December 14, 2023, 7:14am UTC](https://discuss.elastic.co/t/after-upgrading-macos-to-14-x-the-elasticendpoint-authorization-is-automatically-closed-by-the-fda/349328 "2023-12-14T07:14:32Z")
After installing elastic agent version 8.4.1 and 8.9.1, I have clicked and checked in FDA to authorize ElasticEndpoint. However, after running on the computer for a period of time, the macos version is upgraded to 14.0, … --- ## [Correlating/Matching data from 2 sources with diferent field types](https://discuss.elastic.co/t/correlating-matching-data-from-2-sources-with-diferent-field-types/349218)
**Author:** [@erni23](https://discuss.elastic.co/u/erni23)\ **Replies:** 2\ **Last updated:** [December 13, 2023, 5:17pm UTC](https://discuss.elastic.co/t/correlating-matching-data-from-2-sources-with-diferent-field-types/349218 "2023-12-13T17:17:55Z")
This is the scenario and I am using elastic 7.17; •Data source 1: VPN Network traffic data ingested with the usual fields (event.outcome: "success" and event.action: "login” etc (JSON) And •Data source 2: Logs from do… --- ## [Multiple hosts in one Java Rest Client with different API Keys](https://discuss.elastic.co/t/multiple-hosts-in-one-java-rest-client-with-different-api-keys/349069)
**Author:** [@aliaksei\_dev](https://discuss.elastic.co/u/aliaksei_dev)\ **Replies:** 1\ **Last updated:** [December 12, 2023, 1:33pm UTC](https://discuss.elastic.co/t/multiple-hosts-in-one-java-rest-client-with-different-api-keys/349069 "2023-12-12T13:33:04Z")
Hi, having trouble with implementing Java Rest Client v.7.17 - the requirement is to use multiple hosts with one client. At the same time our elastic uses Api Keys with header "Authorization" to authorize. So my question… --- ## [Display rules in a dashboard](https://discuss.elastic.co/t/display-rules-in-a-dashboard/348671)
**Author:** [@rlao](https://discuss.elastic.co/u/rlao)\ **Replies:** 0\ **Last updated:** [December 5, 2023, 7:21pm UTC](https://discuss.elastic.co/t/display-rules-in-a-dashboard/348671 "2023-12-05T19:21:37Z")
Trying to find a way for non admin users to be able to see all Kibana rules without being able to edit them. Since the rules are managed as part of the Admin space, and granting access to admin with carefully controlled… --- ## [ELK custom rule not working](https://discuss.elastic.co/t/elk-custom-rule-not-working/348809)
**Author:** [@theacodes](https://discuss.elastic.co/u/theacodes)\ **Replies:** 1\ **Last updated:** [December 7, 2023, 6:36pm UTC](https://discuss.elastic.co/t/elk-custom-rule-not-working/348809 "2023-12-07T18:36:09Z")
elk v 8.8.1 what could be the issue? --- ## [Alerts Page Only Shows for Threat Intel rule](https://discuss.elastic.co/t/alerts-page-only-shows-for-threat-intel-rule/348751)
**Author:** [@sourcreamnormanbates](https://discuss.elastic.co/u/sourcreamnormanbates)\ **Replies:** 2\ **Last updated:** [December 7, 2023, 2:29pm UTC](https://discuss.elastic.co/t/alerts-page-only-shows-for-threat-intel-rule/348751 "2023-12-07T14:29:52Z")
When I'm on the Detection & Response page, I am seeing alerts for various SIEM rules. However; when I go to the Alerts page, I only see alerts from the Threat Intelligence alerts. No other alerts are displayed. --- ## [ELK Stack Events Per Second and Flow Per Minute](https://discuss.elastic.co/t/elk-stack-events-per-second-and-flow-per-minute/348660)
**Author:** [@Guestaba](https://discuss.elastic.co/u/Guestaba)\ **Replies:** 1\ **Last updated:** [December 5, 2023, 3:57pm UTC](https://discuss.elastic.co/t/elk-stack-events-per-second-and-flow-per-minute/348660 "2023-12-05T15:57:39Z")
Hi everyone, I have and ELK Stack as a SIEM and I am trying to know what are the Events Per Second and the Flow Per Minute of my SIEM. Can someone help me figure this out Thanks in advance --- ## [Endpoint Agent clock problem in sleep mode](https://discuss.elastic.co/t/endpoint-agent-clock-problem-in-sleep-mode/347741)
**Author:** [@simoner](https://discuss.elastic.co/u/simoner)\ **Replies:** 4\ **Last updated:** [November 30, 2023, 11:14pm UTC](https://discuss.elastic.co/t/endpoint-agent-clock-problem-in-sleep-mode/347741 "2023-11-30T23:14:08Z")
Hello, I found a problem with Endpoint agent and sleep mode. When my computer wakes itself up from sleep mode Endpoint Agent logs: {"file":{"line":140,"name":"Entry.cpp"}}},"message":"Entry.cpp:140 The system clock ad… --- ## [ServiceNow SecOps connector](https://discuss.elastic.co/t/servicenow-secops-connector/348374)
**Author:** [@John\_McAfee1](https://discuss.elastic.co/u/John_McAfee1)\ **Replies:** 0\ **Last updated:** [November 30, 2023, 10:20pm UTC](https://discuss.elastic.co/t/servicenow-secops-connector/348374 "2023-11-30T22:20:09Z")
Hello, I am testing the SecOps service now connector on my Personal Development Instance provided by serive now. I have followed the instructions outlined in the documentation: ServiceNow SecOps connector and action | … --- ## [Elastic SIEM Detections](https://discuss.elastic.co/t/elastic-siem-detections/348212)
**Author:** [@The\_BlueishSky](https://discuss.elastic.co/u/The_BlueishSky)\ **Replies:** 2\ **Last updated:** [November 29, 2023, 11:24am UTC](https://discuss.elastic.co/t/elastic-siem-detections/348212 "2023-11-29T11:24:23Z")
How to manage Rule exemptions in Elastic SIEM, We have 1000+ alerts in elastic and we would like to understand how do we manage the whitelisting on each detections. Ex- we make some exemption on any rule, how do we maint… --- ## [Indicator Detection](https://discuss.elastic.co/t/indicator-detection/347862)
**Author:** [@Phoenix1](https://discuss.elastic.co/u/Phoenix1)\ **Replies:** 3\ **Last updated:** [November 28, 2023, 4:49pm UTC](https://discuss.elastic.co/t/indicator-detection/347862 "2023-11-28T16:49:55Z")
I want to use a CSV(Indicator file) lookup to detect the indicators available in the file to report an alert. please suggest. --- ## [Data\_stream.namespace in subject for Jira Action](https://discuss.elastic.co/t/data-stream-namespace-in-subject-for-jira-action/347459)
**Author:** [@jguilford](https://discuss.elastic.co/u/jguilford)\ **Replies:** 1\ **Last updated:** [November 28, 2023, 1:36am UTC](https://discuss.elastic.co/t/data-stream-namespace-in-subject-for-jira-action/347459 "2023-11-28T01:36:54Z")
Trying to use the data\_stream.namespace in the subject for Jira Action, but it does not pull any data, I see the data in the json for the alert. Please help. { "\_index": ".internal.alerts-security.alerts-default-000001… --- ## [Healthy agents not appearing in endpoint security](https://discuss.elastic.co/t/healthy-agents-not-appearing-in-endpoint-security/347239)
**Author:** [@eric10](https://discuss.elastic.co/u/eric10)\ **Replies:** 3\ **Last updated:** [November 27, 2023, 10:48pm UTC](https://discuss.elastic.co/t/healthy-agents-not-appearing-in-endpoint-security/347239 "2023-11-27T22:48:53Z")
I'm having issues finding any information on this... I've seen similar posts, but i see that they've been closed out due to no response... I have a healthy agent on a windows host that is able to successfully enroll into… --- ## [Elastic Security - what is the difference between adding something to the fleet, and a host / endpoint?](https://discuss.elastic.co/t/elastic-security-what-is-the-difference-between-adding-something-to-the-fleet-and-a-host-endpoint/348086)
**Author:** [@jordan\_pritchard](https://discuss.elastic.co/u/jordan_pritchard)\ **Replies:** 0\ **Last updated:** [November 27, 2023, 8:56pm UTC](https://discuss.elastic.co/t/elastic-security-what-is-the-difference-between-adding-something-to-the-fleet-and-a-host-endpoint/348086 "2023-11-27T20:56:11Z")
Hi - I've been testing deploying Elastic Agent. The agent installs without error and I see the agent show up in the fleet, but on roughly half the servers I am testing on, I don't see them show up in Hosts or Endpoints. … --- ## [Encryption of saved logs](https://discuss.elastic.co/t/encryption-of-saved-logs/347612)
**Author:** [@Hamada](https://discuss.elastic.co/u/Hamada)\ **Replies:** 5\ **Last updated:** [November 24, 2023, 1:08am UTC](https://discuss.elastic.co/t/encryption-of-saved-logs/347612 "2023-11-24T01:08:57Z")
I am using Elastic 8.1 in a Windows environment, How do you implement encryption of saved logs? --- ## [AKAMAI SIEM Integration not working](https://discuss.elastic.co/t/akamai-siem-integration-not-working/347173)
**Author:** [@jvgarita](https://discuss.elastic.co/u/jvgarita)\ **Replies:** 0\ **Last updated:** [November 14, 2023, 11:18pm UTC](https://discuss.elastic.co/t/akamai-siem-integration-not-working/347173 "2023-11-14T23:18:20Z")
Hi all, I have deployed an ELK server using version 8.11.0 ad used the option for AKAMAI SIEM integration but the visualization pane is giving me an error "Could not locate field: akamai.siem.rules.ruleTags" and is not s… --- ## [Https://docker.elastic.co/v2/ not accessible - can't download integration repo](https://discuss.elastic.co/t/https-docker-elastic-co-v2-not-accessible-cant-download-integration-repo/347716)
**Author:** [@jojoke13](https://discuss.elastic.co/u/jojoke13)\ **Replies:** 0\ **Last updated:** [November 22, 2023, 10:16am UTC](https://discuss.elastic.co/t/https-docker-elastic-co-v2-not-accessible-cant-download-integration-repo/347716 "2023-11-22T10:16:52Z")
Hi everyone ! I'm in an air-gapped environnement, so to use integration i need to install the docker repository, as stated in this tutorial : Air-gapped environments | Fleet and Elastic Agent Guide \[8.11\] | Elastic Ho… --- ## [Recover file from quarantine](https://discuss.elastic.co/t/recover-file-from-quarantine/346973)
**Author:** [@GKre](https://discuss.elastic.co/u/GKre)\ **Replies:** 9\ **Last updated:** [November 21, 2023, 8:32am UTC](https://discuss.elastic.co/t/recover-file-from-quarantine/346973 "2023-11-21T08:32:22Z")
well - Security quarantined nnotes.dll that is part of "HCL Notes" Installation. Now i am trying to find out how to get back the file without the need to reinstall the application. I created a rule exception and i can … --- ## [Elastic SIEM enterprise SOC use cases](https://discuss.elastic.co/t/elastic-siem-enterprise-soc-use-cases/347031)
**Author:** [@ksrawat88](https://discuss.elastic.co/u/ksrawat88)\ **Replies:** 1\ **Last updated:** [November 17, 2023, 6:20am UTC](https://discuss.elastic.co/t/elastic-siem-enterprise-soc-use-cases/347031 "2023-11-17T06:20:09Z")
Is anyone using Elastic SIEM enterprise version.? how do you find it day to day SOC uses comparing with splunk and qradar .? also is there any common security use case you were not able to achieve by elastic SIEM .? --- ## [Google Workspace integration - logs-sdk admin](https://discuss.elastic.co/t/google-workspace-integration-logs-sdk-admin/347257)
**Author:** [@Eldr](https://discuss.elastic.co/u/Eldr)\ **Replies:** 1\ **Last updated:** [November 16, 2023, 12:23pm UTC](https://discuss.elastic.co/t/google-workspace-integration-logs-sdk-admin/347257 "2023-11-16T12:23:29Z")
I get this error despite following Elastic's documentation to the letter. this is the error (No authentication credentials were configured or detectec (ADC) accesing 'auth.oauth2') Also, I don't understand what this… --- ## [Aggs in DSL](https://discuss.elastic.co/t/aggs-in-dsl/346910)
**Author:** [@Sayantica\_Ganguly](https://discuss.elastic.co/u/Sayantica_Ganguly)\ **Replies:** 6\ **Last updated:** [November 16, 2023, 7:32am UTC](https://discuss.elastic.co/t/aggs-in-dsl/346910 "2023-11-16T07:32:06Z")
when I create a new rule in Custom query with DSL for the query Login Authentication Condition 1: Count of failed login attempts for the same user account is greater than or equal to 5 within the last 2 minutes. Cond… --- ## [How to integrate SCIM Server (Basic Auth) with SailPoint IIQ?](https://discuss.elastic.co/t/how-to-integrate-scim-server-basic-auth-with-sailpoint-iiq/347185)
**Author:** [@srikanth\_bollu](https://discuss.elastic.co/u/srikanth_bollu)\ **Replies:** 0\ **Last updated:** [November 15, 2023, 4:15am UTC](https://discuss.elastic.co/t/how-to-integrate-scim-server-basic-auth-with-sailpoint-iiq/347185 "2023-11-15T04:15:43Z")
I am running Okta's Example SCIM (v2.0) Server and I wish to know how to integrate it with SailPoint IIQ. It asks for the Basic Authentication username and password. However, the example app has not authentication config… --- ## [When will the patch be available for CVE-2023-38552/39331/39332/44487 upgrading nodejs \>= 18.18.2](https://discuss.elastic.co/t/when-will-the-patch-be-available-for-cve-2023-38552-39331-39332-44487-upgrading-nodejs-18-18-2/346356)
**Author:** [@stanislasm](https://discuss.elastic.co/u/stanislasm)\ **Replies:** 8\ **Last updated:** [November 14, 2023, 9:58pm UTC](https://discuss.elastic.co/t/when-will-the-patch-be-available-for-cve-2023-38552-39331-39332-44487-upgrading-nodejs-18-18-2/346356 "2023-11-14T21:58:24Z")
Hello, When will the fix for CVE-2023-38552/39331/39332/44487 upgrading nodejs \>= 18.18.2 be available in the Kibana 8.10.x version? Thanks --- ## [False positive report](https://discuss.elastic.co/t/false-positive-report/347155)
**Author:** [@armada](https://discuss.elastic.co/u/armada)\ **Replies:** 2\ **Last updated:** [November 14, 2023, 7:46pm UTC](https://discuss.elastic.co/t/false-positive-report/347155 "2023-11-14T19:46:13Z")
Hi, we followed your advice and forwarded a false positive report to fp\_reports@elastic.co but have not received any response. Pls advise: As a result of this nonsense, Lurkit terminated our service contract and suffere… --- ## [Detection rules: include Kibana visualization in email](https://discuss.elastic.co/t/detection-rules-include-kibana-visualization-in-email/347159)
**Author:** [@cdelgado](https://discuss.elastic.co/u/cdelgado)\ **Replies:** 0\ **Last updated:** [November 14, 2023, 7:20pm UTC](https://discuss.elastic.co/t/detection-rules-include-kibana-visualization-in-email/347159 "2023-11-14T19:20:52Z")
Hi all, Is there any way to include Kibana visualizations (i.e., from Visualize Library) in the Email action of a Detection Rule? I am looking for different available options to include more complex forms of data on a … --- ## [Failed execution of ESQL query and high cpu load](https://discuss.elastic.co/t/failed-execution-of-esql-query-and-high-cpu-load/346992)
**Author:** [@Stefan\_Sabolowitsch](https://discuss.elastic.co/u/Stefan_Sabolowitsch)\ **Replies:** 15\ **Last updated:** [November 14, 2023, 4:04pm UTC](https://discuss.elastic.co/t/failed-execution-of-esql-query-and-high-cpu-load/346992 "2023-11-14T16:04:54Z")
Hi There, I have a one node cluster here for testing. Hardware Spec: 16 Core // 148GB // 6 SAS 15K Raid0 Everything is running smoothly except for Elastic Security. As soon as i perform an action here, i get Kibana … --- ## [Elastic Defend - Is default logging on the endpoint enough?](https://discuss.elastic.co/t/elastic-defend-is-default-logging-on-the-endpoint-enough/346296)
**Author:** [@h49nakxs](https://discuss.elastic.co/u/h49nakxs)\ **Replies:** 2\ **Last updated:** [November 14, 2023, 9:27am UTC](https://discuss.elastic.co/t/elastic-defend-is-default-logging-on-the-endpoint-enough/346296 "2023-11-14T09:27:54Z")
Hello, If I use "Elastic Defend" integration, will all the Elastic Security detection rules get enough information to be triggered or do I need to enhance the logging on the endpoints (for example with Sysmon on Windows… --- ## [Detection rule: Email CSV file as action](https://discuss.elastic.co/t/detection-rule-email-csv-file-as-action/347065)
**Author:** [@cdelgado](https://discuss.elastic.co/u/cdelgado)\ **Replies:** 0\ **Last updated:** [November 13, 2023, 10:12pm UTC](https://discuss.elastic.co/t/detection-rule-email-csv-file-as-action/347065 "2023-11-13T22:12:19Z")
Hello, When configuring Detection Rules, is there a way to send a CSV file as part of the Email action (when the rule triggers)? I am aware Mustache and Markdown syntax is supported for the email body, but I was wonderi… [Previous page](https://discuss.elastic.co/c/security/83.md?page=17) [Next page](https://discuss.elastic.co/c/security/83.md?page=19)