# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=19 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 20 --- ## [Can we consolidate or correlate simliar incidents](https://discuss.elastic.co/t/can-we-consolidate-or-correlate-simliar-incidents/346304)
**Author:** [@ksrawat88](https://discuss.elastic.co/u/ksrawat88)\ **Replies:** 3\ **Last updated:** [November 13, 2023, 3:02pm UTC](https://discuss.elastic.co/t/can-we-consolidate-or-correlate-simliar-incidents/346304 "2023-11-13T15:02:33Z")
We are using open source ELK stack and we have different log sources enabled. Is there anyway we can have log correlation between different log sources. For example if we search for one IP or user we can see all logs fr… --- ## [Detection alerts not visible to all users](https://discuss.elastic.co/t/detection-alerts-not-visible-to-all-users/346456)
**Author:** [@abubacker](https://discuss.elastic.co/u/abubacker)\ **Replies:** 2\ **Last updated:** [November 13, 2023, 8:57am UTC](https://discuss.elastic.co/t/detection-alerts-not-visible-to-all-users/346456 "2023-11-13T08:57:57Z")
Hi All, Elastic detection alerts are not visible to all users and are highlighted in yellow. All other alerts are visible some alerts only have this issue. If anyone knows how to solve this issue please let me know w… --- ## [Where are Security Rules run?](https://discuss.elastic.co/t/where-are-security-rules-run/346753)
**Author:** [@digital-thought](https://discuss.elastic.co/u/digital-thought)\ **Replies:** 4\ **Last updated:** [November 10, 2023, 12:43pm UTC](https://discuss.elastic.co/t/where-are-security-rules-run/346753 "2023-11-10T12:43:39Z")
The security rules and alerts are fantastic in ELK. Am curious to know, where are the Rules (which dont require Machine Learning) run from? Is it the instance running Kibana or one of the Elastic instances with a speci… --- ## [Threat intel rule stopped working when added exceptions](https://discuss.elastic.co/t/threat-intel-rule-stopped-working-when-added-exceptions/346617)
**Author:** [@theacodes](https://discuss.elastic.co/u/theacodes)\ **Replies:** 4\ **Last updated:** [November 9, 2023, 6:41am UTC](https://discuss.elastic.co/t/threat-intel-rule-stopped-working-when-added-exceptions/346617 "2023-11-09T06:41:56Z")
The threat intel rule stopped working when added some exceptions. any solution? --- ## [Aggregate alerts by a specific field and send a summary through an action for each field value encountered](https://discuss.elastic.co/t/aggregate-alerts-by-a-specific-field-and-send-a-summary-through-an-action-for-each-field-value-encountered/346698)
**Author:** [@Arty](https://discuss.elastic.co/u/Arty)\ **Replies:** 0\ **Last updated:** [November 8, 2023, 10:52am UTC](https://discuss.elastic.co/t/aggregate-alerts-by-a-specific-field-and-send-a-summary-through-an-action-for-each-field-value-encountered/346698 "2023-11-08T10:52:37Z")
Hi everyone, I have set up a Kibana alert security detection rule which creates an alert for all my incoming third-party system alerts (Suricata) and send each one of them to my SIRP using webhook. I have many alerts w… --- ## [Risks of Fleet and endpoint agents](https://discuss.elastic.co/t/risks-of-fleet-and-endpoint-agents/346521)
**Author:** [@ivahbo](https://discuss.elastic.co/u/ivahbo)\ **Replies:** 4\ **Last updated:** [November 8, 2023, 9:57am UTC](https://discuss.elastic.co/t/risks-of-fleet-and-endpoint-agents/346521 "2023-11-08T09:57:00Z")
If the Elastic/Fleet server is compromised, can the compromise be leveraged to gain access to the systems running endpoint agents? For example, can you push a malicious update to endpoint agents? --- ## [Variables and subfields](https://discuss.elastic.co/t/variables-and-subfields/346554)
**Author:** [@B-Rad](https://discuss.elastic.co/u/B-Rad)\ **Replies:** 0\ **Last updated:** [November 6, 2023, 7:01pm UTC](https://discuss.elastic.co/t/variables-and-subfields/346554 "2023-11-06T19:01:16Z")
When working with alerts and using variables in the connectors, is if possible to only use a subset of the data in my notifications? For example, the field name is details, but this field looks to contain its own json d… --- ## [Advance logic alter rules (if "A" happens look for "B"](https://discuss.elastic.co/t/advance-logic-alter-rules-if-a-happens-look-for-b/346529)
**Author:** [@B-Rad](https://discuss.elastic.co/u/B-Rad)\ **Replies:** 0\ **Last updated:** [November 6, 2023, 1:50pm UTC](https://discuss.elastic.co/t/advance-logic-alter-rules-if-a-happens-look-for-b/346529 "2023-11-06T13:50:31Z")
When creating an alert rule is it possible to add some more advanced logic or additional criteria if the first query is triggered? For example, I have authentication logs from our Idp I have an alert rule set for pot… --- ## [Configure Fleet SSL Cert Port 8220](https://discuss.elastic.co/t/configure-fleet-ssl-cert-port-8220/346157)
**Author:** [@sourcreamnormanbates](https://discuss.elastic.co/u/sourcreamnormanbates)\ **Replies:** 2\ **Last updated:** [November 1, 2023, 12:49pm UTC](https://discuss.elastic.co/t/configure-fleet-ssl-cert-port-8220/346157 "2023-11-01T12:49:36Z")
I have deployed a Fleet server and I want to change the SSL cert that is being used. Is there a config file somewhere that I can modify to use the certificates that I generated? I want to avoid having to use the --inse… --- ## [Elastic Defend: Unexpected error occurred during diagnostic memory scan: Success](https://discuss.elastic.co/t/elastic-defend-unexpected-error-occurred-during-diagnostic-memory-scan-success/346100)
**Author:** [@aqiank](https://discuss.elastic.co/u/aqiank)\ **Replies:** 2\ **Last updated:** [November 1, 2023, 1:50am UTC](https://discuss.elastic.co/t/elastic-defend-unexpected-error-occurred-during-diagnostic-memory-scan-success/346100 "2023-11-01T01:50:37Z")
Hi, I added Elastic Defend integration to an active policy and I noticed messages like the one below on the host's logs. \[elastic\_agent.endpoint\_security\]\[warning\] MemoryScan.cpp:677 Unexpected error occurred during dia… --- ## [ElasticEndpoint authorization is automatically closed in FDA](https://discuss.elastic.co/t/elasticendpoint-authorization-is-automatically-closed-in-fda/345693)
**Author:** [@xqaiviwjxzw](https://discuss.elastic.co/u/xqaiviwjxzw)\ **Replies:** 2\ **Last updated:** [October 31, 2023, 3:42am UTC](https://discuss.elastic.co/t/elasticendpoint-authorization-is-automatically-closed-in-fda/345693 "2023-10-31T03:42:26Z")
After installing elastic agent versions 8.4.1 and 8.9.1, I have clicked and checked in FDA to authorize ElasticEndpoint. However, after running on the computer for a period of time, the authorization of ElasticEndpoint i… --- ## [Monitoring process elastic-endpoint.exe](https://discuss.elastic.co/t/monitoring-process-elastic-endpoint-exe/345944)
**Author:** [@vlados31999](https://discuss.elastic.co/u/vlados31999)\ **Replies:** 1\ **Last updated:** [October 27, 2023, 5:42pm UTC](https://discuss.elastic.co/t/monitoring-process-elastic-endpoint-exe/345944 "2023-10-27T17:42:31Z")
Colleagues Hi, everybody There was a need to monitor the impact of the process elastic-endpoint.exe on CPU and RAM The problem is that I don't see information about this process from any hosts on which Elastic Endpoin… --- ## [Notes on Alerts or auto open case](https://discuss.elastic.co/t/notes-on-alerts-or-auto-open-case/345771)
**Author:** [@Renato\_Arraes](https://discuss.elastic.co/u/Renato_Arraes)\ **Replies:** 0\ **Last updated:** [October 26, 2023, 5:41am UTC](https://discuss.elastic.co/t/notes-on-alerts-or-auto-open-case/345771 "2023-10-26T05:41:51Z")
Hello everyone, Im currently doing the configuration of the Alerts, and i want to know if theres a way to put some notes or open directly a case from an alert, since we do have to treat the Alerts we need to input some … --- ## [How to use Elastic Search CA Cert with OpenTelemetry?](https://discuss.elastic.co/t/how-to-use-elastic-search-ca-cert-with-opentelemetry/345667)
**Author:** [@vsabado](https://discuss.elastic.co/u/vsabado)\ **Replies:** 21\ **Last updated:** [October 25, 2023, 3:59pm UTC](https://discuss.elastic.co/t/how-to-use-elastic-search-ca-cert-with-opentelemetry/345667 "2023-10-25T15:59:34Z")
I downloaded the CA Cert from my Elasticsearch cloud instance and put it in /usr/local/share/ca-certificates/. I then ran update-ca-certificates, which created a .pem file of my certificate under /etc/ssl/certs. I updat… --- ## [Is there any api or plugin for alarming/popup when an attack is detected?](https://discuss.elastic.co/t/is-there-any-api-or-plugin-for-alarming-popup-when-an-attack-is-detected/344517)
**Author:** [@lilyyy](https://discuss.elastic.co/u/lilyyy)\ **Replies:** 1\ **Last updated:** [October 25, 2023, 9:17am UTC](https://discuss.elastic.co/t/is-there-any-api-or-plugin-for-alarming-popup-when-an-attack-is-detected/344517 "2023-10-25T09:17:42Z")
Hello all, When an attack is detected, I want to show someone in a glance we detect the attack likes popup or sounds on kibana. Is there any api or plugin related with it? Thanks --- ## [Problem with security timelines for alias](https://discuss.elastic.co/t/problem-with-security-timelines-for-alias/343966)
**Author:** [@kmz161](https://discuss.elastic.co/u/kmz161)\ **Replies:** 0\ **Last updated:** [September 27, 2023, 9:34am UTC](https://discuss.elastic.co/t/problem-with-security-timelines-for-alias/343966 "2023-09-27T09:34:04Z")
Hello! I use alias for aggregate and display log log from different sources and I often use alias for SIEM rules and it is work great. But I can't use alias for timeline. When I choose alias in timeline I can't choos… --- ## [Detect the deactivation of log events with Elastic ML](https://discuss.elastic.co/t/detect-the-deactivation-of-log-events-with-elastic-ml/345615)
**Author:** [@phillo197](https://discuss.elastic.co/u/phillo197)\ **Replies:** 0\ **Last updated:** [October 24, 2023, 7:40am UTC](https://discuss.elastic.co/t/detect-the-deactivation-of-log-events-with-elastic-ml/345615 "2023-10-24T07:40:23Z")
Can someone please help me. I am new to Elastic ML and I need help to configure a Elastic ML-Job, which detects the deactivation of the transmission of log events. --- ## [An error occurred during rule execution: message: "Current rule execution has exceeded its allotted interval (5m) and has been stopped](https://discuss.elastic.co/t/an-error-occurred-during-rule-execution-message-current-rule-execution-has-exceeded-its-allotted-interval-5m-and-has-been-stopped/345434)
**Author:** [@galuh\_tirta](https://discuss.elastic.co/u/galuh_tirta)\ **Replies:** 1\ **Last updated:** [October 20, 2023, 2:57pm UTC](https://discuss.elastic.co/t/an-error-occurred-during-rule-execution-message-current-rule-execution-has-exceeded-its-allotted-interval-5m-and-has-been-stopped/345434 "2023-10-20T14:57:23Z")
hai everyone , what should i do to fix this An error occurred during rule execution: message: "Current rule execution has exceeded its allotted interval (5m) and has been stopped --- ## [EQL sequence detection on windows and cloudtrail](https://discuss.elastic.co/t/eql-sequence-detection-on-windows-and-cloudtrail/345383)
**Author:** [@sholzhauer](https://discuss.elastic.co/u/sholzhauer)\ **Replies:** 0\ **Last updated:** [October 19, 2023, 11:36am UTC](https://discuss.elastic.co/t/eql-sequence-detection-on-windows-and-cloudtrail/345383 "2023-10-19T11:36:33Z")
Hi all,I have a bit of a challenge in building a detection, hoping someone has a good idea. scenario We have a couple of windows hosts in a dedicated aws account which should only be turned on temporary. I am looking t… --- ## [Many open alarms (building blocks) due to Correlation rules](https://discuss.elastic.co/t/many-open-alarms-building-blocks-due-to-correlation-rules/345014)
**Author:** [@siiman](https://discuss.elastic.co/u/siiman)\ **Replies:** 1\ **Last updated:** [October 19, 2023, 9:55am UTC](https://discuss.elastic.co/t/many-open-alarms-building-blocks-due-to-correlation-rules/345014 "2023-10-19T09:55:46Z")
Hello all, TL;DR When an alert is triggered by a correlation rule, the linked alerts (building blocks) are not automatically closed with the "main alert". This results in a large number of unnoticed open alerts. Probl… --- ## [Detect previous password change in bruteforce detection rule](https://discuss.elastic.co/t/detect-previous-password-change-in-bruteforce-detection-rule/344881)
**Author:** [@e.vedelaar](https://discuss.elastic.co/u/e.vedelaar)\ **Replies:** 2\ **Last updated:** [October 17, 2023, 2:25pm UTC](https://discuss.elastic.co/t/detect-previous-password-change-in-bruteforce-detection-rule/344881 "2023-10-17T14:25:33Z")
Hi, we built a bruteforce use case which detects winlog bruteforces. The query is as follows: event.category : "authentication" and event.outcome : "failure" and (winlog.event\_data.Status: "0x18" or winlog.event\_data.St… --- ## [Kibana giving unauthenticated first time but allowing to login second time in same session](https://discuss.elastic.co/t/kibana-giving-unauthenticated-first-time-but-allowing-to-login-second-time-in-same-session/344984)
**Author:** [@amitkumar.gupta](https://discuss.elastic.co/u/amitkumar.gupta)\ **Replies:** 1\ **Last updated:** [October 17, 2023, 5:18am UTC](https://discuss.elastic.co/t/kibana-giving-unauthenticated-first-time-but-allowing-to-login-second-time-in-same-session/344984 "2023-10-17T05:18:04Z")
I have enabled Kibana login from wso2 API manager. below I have provided Elastic configuration file. I am following instruction to configure wso2 and kibana- https://shanchathusanda.medium.com/log-in-to-elastic-stack-w… --- ## [Failed to close alert(s)](https://discuss.elastic.co/t/failed-to-close-alert-s/343832)
**Author:** [@IsItPossible](https://discuss.elastic.co/u/IsItPossible)\ **Replies:** 4\ **Last updated:** [October 13, 2023, 10:42pm UTC](https://discuss.elastic.co/t/failed-to-close-alert-s/343832 "2023-10-13T22:42:16Z")
Hello, Im using version 8.5.1 and since 25.09 around 12pm European time, im not able to close alerts or mark it as acknowledge. It returns an empty error message: The upload feature doesn't work so I cannot put a scree… --- ## [Unhealthy - (DEGRADED) Applied policy - Failure enabling network events; current state is disabled](https://discuss.elastic.co/t/unhealthy-degraded-applied-policy-failure-enabling-network-events-current-state-is-disabled/344477)
**Author:** [@dmgeurts](https://discuss.elastic.co/u/dmgeurts)\ **Replies:** 13\ **Last updated:** [October 13, 2023, 9:41pm UTC](https://discuss.elastic.co/t/unhealthy-degraded-applied-policy-failure-enabling-network-events-current-state-is-disabled/344477 "2023-10-13T21:41:26Z")
Elastic-agent v8.10.2 deployed on Fedora 37, has been running for months without issue. Noticed today that it's flagged as unhealthy. The same agent version and policy have been and are working fine on CentOS, Ubuntu etc… --- ## [No alias for PEM certificate when using elasticsearch-certutil cert](https://discuss.elastic.co/t/no-alias-for-pem-certificate-when-using-elasticsearch-certutil-cert/344977)
**Author:** [@Francesco66](https://discuss.elastic.co/u/Francesco66)\ **Replies:** 0\ **Last updated:** [October 13, 2023, 9:44am UTC](https://discuss.elastic.co/t/no-alias-for-pem-certificate-when-using-elasticsearch-certutil-cert/344977 "2023-10-13T09:44:12Z")
Hello, I have an application that needs to communicate to Logstash in TLS (one way) secure mode. More specifically these are the requirements to setup such secured connection: \*\*Supported certificate format … --- ## [Elastic Defend - Folder- Extensions and Process-exceptions](https://discuss.elastic.co/t/elastic-defend-folder-extensions-and-process-exceptions/344810)
**Author:** [@slash24](https://discuss.elastic.co/u/slash24)\ **Replies:** 1\ **Last updated:** [October 12, 2023, 7:37pm UTC](https://discuss.elastic.co/t/elastic-defend-folder-extensions-and-process-exceptions/344810 "2023-10-12T19:37:35Z")
When using elastic defend on enterprise workloads (Windows Servers), I want to adhere and follow official list of AV exclusions. These guidelines often includes Processes, folders, specific file-extensions (again, window… --- ## [Windows defender logs](https://discuss.elastic.co/t/windows-defender-logs/344532)
**Author:** [@cara\_es](https://discuss.elastic.co/u/cara_es)\ **Replies:** 3\ **Last updated:** [October 11, 2023, 1:59pm UTC](https://discuss.elastic.co/t/windows-defender-logs/344532 "2023-10-11T13:59:45Z")
Hi. How can i get logs from windows defender to Elasticsearch the log are in EventViewer -\> Applications and Services Logs Microsoft - Windows - Windows Defender - Operational Kind regards Carsten --- ## [Event Filters & Wildcards](https://discuss.elastic.co/t/event-filters-wildcards/343295)
**Author:** [@DefensiveDepth](https://discuss.elastic.co/u/DefensiveDepth)\ **Replies:** 6\ **Last updated:** [October 10, 2023, 2:09pm UTC](https://discuss.elastic.co/t/event-filters-wildcards/343295 "2023-10-10T14:09:03Z")
According to the docs, it sounds like the only way to use wildcards is with matches and file.path.text ? So using is with an asterisk at the beginning or end going to interpret that as a literal asterisk? --- ## [Troubleshoot Elastic Endpoint Unhealthy](https://discuss.elastic.co/t/troubleshoot-elastic-endpoint-unhealthy/344540)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 4\ **Last updated:** [October 9, 2023, 2:41pm UTC](https://discuss.elastic.co/t/troubleshoot-elastic-endpoint-unhealthy/344540 "2023-10-09T14:41:00Z")
Hello, We are doing a PoC with the Elastic Agent and one of our agent host in this scenario became UNHEALTHY after an upgrade. We have the following ingestion flow: Elastic Agent -\> HAProxy (passthrough) -\> Logstash -\>… --- ## [Elastic Defend Degraded - Configure Network Events](https://discuss.elastic.co/t/elastic-defend-degraded-configure-network-events/344297)
**Author:** [@GKre](https://discuss.elastic.co/u/GKre)\ **Replies:** 3\ **Last updated:** [October 4, 2023, 12:39am UTC](https://discuss.elastic.co/t/elastic-defend-degraded-configure-network-events/344297 "2023-10-04T00:39:24Z")
Hi there, i rolled out elastic defend to my kali linux vm. On this machine the Agend is degraded with Elastic Defend showing a problem "configure network events". {"@timestamp":"2023-09-30T10:41:44.190134275Z","agent"… [Previous page](https://discuss.elastic.co/c/security/83.md?page=18) [Next page](https://discuss.elastic.co/c/security/83.md?page=20)