# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=2 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 3 --- ## [Elastic External Connector Question](https://discuss.elastic.co/t/elastic-external-connector-question/385470)
**Author:** [@vpolius](https://discuss.elastic.co/u/vpolius)\ **Replies:** 0\ **Last updated:** [March 16, 2026, 4:06pm UTC](https://discuss.elastic.co/t/elastic-external-connector-question/385470 "2026-03-16T16:06:19Z")
I was wondering if there was a way to prevent the external connector from adding a link back to the case in elastic when creating a connection with ServiceNow. --- ## [Is Elastic Endpoint immune to Zombie ZIP evasion?](https://discuss.elastic.co/t/is-elastic-endpoint-immune-to-zombie-zip-evasion/385438)
**Author:** [@Kenny-Yeh](https://discuss.elastic.co/u/Kenny-Yeh)\ **Replies:** 1\ **Last updated:** [March 16, 2026, 9:55am UTC](https://discuss.elastic.co/t/is-elastic-endpoint-immune-to-zombie-zip-evasion/385438 "2026-03-16T09:55:35Z")
“Zombie ZIP“ is a newly disclosed malware evasion technique where attackers manipulate ZIP archive headers to bypass antivirus and EDR scanning. Based on the test by the researcher, it works against most AV engines on Vi… --- ## [AI Agent feedback](https://discuss.elastic.co/t/ai-agent-feedback/385435)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 0\ **Last updated:** [March 12, 2026, 8:58pm UTC](https://discuss.elastic.co/t/ai-agent-feedback/385435 "2026-03-12T20:58:01Z")
Hello, I would like to share some feedback and also ask for guidance regarding the AI Agent feature in Elastic 9.x. First, I want to clarify that this is not intended as criticism. I’m sharing my experience after upgra… --- ## [Threat Intelligence View Not Using securitySolution:defaultThreatIndex](https://discuss.elastic.co/t/threat-intelligence-view-not-using-securitysolution-defaultthreatindex/385403)
**Author:** [@logalicious](https://discuss.elastic.co/u/logalicious)\ **Replies:** 1\ **Last updated:** [March 12, 2026, 2:30pm UTC](https://discuss.elastic.co/t/threat-intelligence-view-not-using-securitysolution-defaultthreatindex/385403 "2026-03-12T14:30:00Z")
I am working on developing threat intelligence integrations and have noticed that most integrations use the logs-ti\_\* naming format for both the original index (e.g., logs-ti\_crowdstrike.ioc-default) and the transform de… --- ## [Using Case templates in Attack Discovery scheduling](https://discuss.elastic.co/t/using-case-templates-in-attack-discovery-scheduling/385398)
**Author:** [@wsouza](https://discuss.elastic.co/u/wsouza)\ **Replies:** 3\ **Last updated:** [March 12, 2026, 12:59pm UTC](https://discuss.elastic.co/t/using-case-templates-in-attack-discovery-scheduling/385398 "2026-03-12T12:59:58Z")
Hi folks. I'd like to know if there's a way to use a template for scheduled tasks in Attack Discovery. The information I've received is that Attack Discovery automatically fills in the fields, but is there any way to edi… --- ## [Threat Intel Rules and Threat Enrichments](https://discuss.elastic.co/t/threat-intel-rules-and-threat-enrichments/385093)
**Author:** [@K4ruzo](https://discuss.elastic.co/u/K4ruzo)\ **Replies:** 1\ **Last updated:** [March 10, 2026, 6:07pm UTC](https://discuss.elastic.co/t/threat-intel-rules-and-threat-enrichments/385093 "2026-03-10T18:07:44Z")
I have some questions about the timing of detection rules and their threat enrichments. I am working with the prebuilt rule “Threat Intel IP Address Indicator Match” and I am trying to reduce false positives. My goal is… --- ## [Clarification on using "timestamp\_override: event.ingested" with EQL sequence rules](https://discuss.elastic.co/t/clarification-on-using-timestamp-override-event-ingested-with-eql-sequence-rules/385377)
**Author:** [@iremtoru](https://discuss.elastic.co/u/iremtoru)\ **Replies:** 0\ **Last updated:** [March 9, 2026, 11:22am UTC](https://discuss.elastic.co/t/clarification-on-using-timestamp-override-event-ingested-with-eql-sequence-rules/385377 "2026-03-09T11:22:02Z")
Hello, I’m looking for clarification and guidance around the use of timestamp\_override: event.ingested in EQL sequence rules. From my understanding and search of official docs: timestamp\_override: event.ingested is … --- ## [Question About OOS Closure for Elasticsearch Deployment on es.io](https://discuss.elastic.co/t/question-about-oos-closure-for-elasticsearch-deployment-on-es-io/385303)
**Author:** [@Attacker\_Tester](https://discuss.elastic.co/u/Attacker_Tester)\ **Replies:** 1\ **Last updated:** [March 2, 2026, 3:16pm UTC](https://discuss.elastic.co/t/question-about-oos-closure-for-elasticsearch-deployment-on-es-io/385303 "2026-03-02T15:16:06Z")
I noticed that my report regarding a potential DoS bug in the instant Elasticsearch deployment on es.io was marked as out-of-scope (OOS). Could you please clarify why this deployment/domain is considered OOS? I want to m… --- ## [Knowledge Base loading indefinitely](https://discuss.elastic.co/t/knowledge-base-loading-indefinitely/385224)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 1\ **Last updated:** [February 25, 2026, 3:18pm UTC](https://discuss.elastic.co/t/knowledge-base-loading-indefinitely/385224 "2026-02-25T15:18:44Z")
I was using the AI assistant and after finding that I could feed it information about my business, I started creating items in the “Knowledge Base” ITEM. Then I realized that I could give the assistant a role in this ca… --- ## [Elastic - MISP Integration shows total Indicators ( fortigate logs)](https://discuss.elastic.co/t/elastic-misp-integration-shows-total-indicators-fortigate-logs/385132)
**Author:** [@4l13v](https://discuss.elastic.co/u/4l13v)\ **Replies:** 5\ **Last updated:** [February 24, 2026, 11:07am UTC](https://discuss.elastic.co/t/elastic-misp-integration-shows-total-indicators-fortigate-logs/385132 "2026-02-24T11:07:56Z")
Hello community. I am having big issue right now. I have Integrated Fortigate and Elastic. Then attempted to integrate MISP to Elastic. Integration was well till \[Logs MISP\] Dashboard was thinking Total Indicators coun… --- ## [Trial extension request for Elastic ML features on on-premises](https://discuss.elastic.co/t/trial-extension-request-for-elastic-ml-features-on-on-premises/385155)
**Author:** [@abel1](https://discuss.elastic.co/u/abel1)\ **Replies:** 1\ **Last updated:** [February 23, 2026, 12:51pm UTC](https://discuss.elastic.co/t/trial-extension-request-for-elastic-ml-features-on-on-premises/385155 "2026-02-23T12:51:07Z")
Hello, I previously submitted a request to extend my Elastic trial license for 30 days to test Machine Learning features on my self-managed (on-premises) setup. I haven’t received a response yet and would appreciate any… --- ## [Security alerts notes](https://discuss.elastic.co/t/security-alerts-notes/385113)
**Author:** [@Cristina\_Marletta\_Li](https://discuss.elastic.co/u/Cristina_Marletta_Li)\ **Replies:** 2\ **Last updated:** [February 19, 2026, 2:20pm UTC](https://discuss.elastic.co/t/security-alerts-notes/385113 "2026-02-19T14:20:05Z")
Hi all, I added a note to a security alert. The document associated with the alert is viewable in Discover, but I don't see any fields containing my note. In which index is the note stored? I read that it is stored in … --- ## [Independent Agent Version 9.3.0+build202602051825](https://discuss.elastic.co/t/independent-agent-version-9-3-0-build202602051825/385074)
**Author:** [@syk](https://discuss.elastic.co/u/syk)\ **Replies:** 3\ **Last updated:** [February 18, 2026, 10:45pm UTC](https://discuss.elastic.co/t/independent-agent-version-9-3-0-build202602051825/385074 "2026-02-18T22:45:15Z")
Just a quick question (I don’t find anything about that in any release-note..) When upgrading agents via Fleet (in an upgraded 9.3.0 deployment) this “independent release version” will be installed: Following the pr… --- ## [Elastic rule Hyperlinks in Highlighted Fields](https://discuss.elastic.co/t/elastic-rule-hyperlinks-in-highlighted-fields/384894)
**Author:** [@welch27330](https://discuss.elastic.co/u/welch27330)\ **Replies:** 2\ **Last updated:** [February 13, 2026, 2:48am UTC](https://discuss.elastic.co/t/elastic-rule-hyperlinks-in-highlighted-fields/384894 "2026-02-13T02:48:48Z")
Is it possible to create a custom clickable hyperlink in the highlighted fields. The link could be constructed in several ways but generally constructed from data that is present in the alert it self. The reason for thi… --- ## [Elastic Rule Alert With External hyper link field creation in highlighted Fields \[feature request\]](https://discuss.elastic.co/t/elastic-rule-alert-with-external-hyper-link-field-creation-in-highlighted-fields-feature-request/384868)
**Author:** [@welch27330](https://discuss.elastic.co/u/welch27330)\ **Replies:** 2\ **Last updated:** [February 13, 2026, 2:34am UTC](https://discuss.elastic.co/t/elastic-rule-alert-with-external-hyper-link-field-creation-in-highlighted-fields-feature-request/384868 "2026-02-13T02:34:30Z")
Is there a way to construct a URL that will render as a hyper link in the alerts dashboard that will allow the user to review (Highlighted fields) the alert and then show a hyperlink to the external asset that the inform… --- ## [ELK Architecture Distribution for Hardware to Achieve high availability](https://discuss.elastic.co/t/elk-architecture-distribution-for-hardware-to-achieve-high-availability/384936)
**Author:** [@Ammar\_Mostafa](https://discuss.elastic.co/u/Ammar_Mostafa)\ **Replies:** 16\ **Last updated:** [February 11, 2026, 9:22am UTC](https://discuss.elastic.co/t/elk-architecture-distribution-for-hardware-to-achieve-high-availability/384936 "2026-02-11T09:22:20Z")
I want to know how to distribute the nodes VMs across the physical servers to achieve HA my cluster will be contain of these specs below and I want to make something like this --- ## [SIEM reports](https://discuss.elastic.co/t/siem-reports/384985)
**Author:** [@arcsons](https://discuss.elastic.co/u/arcsons)\ **Replies:** 1\ **Last updated:** [February 10, 2026, 9:21pm UTC](https://discuss.elastic.co/t/siem-reports/384985 "2026-02-10T21:21:08Z")
Hi all :slight\_smile: I don’t see any existing siem reports, and currently I have to manually export dashboards, including images and text. Is there a solution for automating this, or am I missing something? Thanks in … --- ## [Exceptions in rules through DaC](https://discuss.elastic.co/t/exceptions-in-rules-through-dac/384790)
**Author:** [@proclick](https://discuss.elastic.co/u/proclick)\ **Replies:** 2\ **Last updated:** [February 9, 2026, 9:43pm UTC](https://discuss.elastic.co/t/exceptions-in-rules-through-dac/384790 "2026-02-09T21:43:35Z")
Greetings, I am not sure that I use right category so I am sorry in advance. Is it possible to add exceptions to the rule using Detection as Code from Elastic directly in the rule file (.toml) without creating a Shared… --- ## [Alerts missing key fields](https://discuss.elastic.co/t/alerts-missing-key-fields/384449)
**Author:** [@michael-a](https://discuss.elastic.co/u/michael-a)\ **Replies:** 3\ **Last updated:** [February 9, 2026, 2:05pm UTC](https://discuss.elastic.co/t/alerts-missing-key-fields/384449 "2026-02-09T14:05:04Z")
We get alerts where key fields like host.name and process.name are missing. Looking at a rule with this issue - "Potential Malware-Driven SSH Brute Force Attempt", which is a threshold rule, all the requirements of the r… --- ## [Features for Elastic SIEM](https://discuss.elastic.co/t/features-for-elastic-siem/377521)
**Author:** [@arcsons](https://discuss.elastic.co/u/arcsons)\ **Replies:** 5\ **Last updated:** [February 9, 2026, 5:36am UTC](https://discuss.elastic.co/t/features-for-elastic-siem/377521 "2026-02-09T05:36:08Z")
Hi Elastic Team, I would like to kindly request the support of the Elastic team and the product owner for Security in enabling more features from Wazuh. It would be fantastic to have enhanced capabilities such as Config… --- ## [ElasticDefendStatus - File not found (v9.3.0)](https://discuss.elastic.co/t/elasticdefendstatus-file-not-found-v9-3-0/384899)
**Author:** [@adamsmesher](https://discuss.elastic.co/u/adamsmesher)\ **Replies:** 4\ **Last updated:** [February 6, 2026, 6:39pm UTC](https://discuss.elastic.co/t/elasticdefendstatus-file-not-found-v9-3-0/384899 "2026-02-06T18:39:33Z")
Hi Everyone! After updating to version 9.3, the Elastic Defend status is not displayed on the endpoints. file:///C:/Program%20Files/Elastic/Endpoint/cache/ElasticDefendStatus.html Register as antivirus - Sync with … --- ## [Impact of CVE-2025-68161 on Elasticsearch](https://discuss.elastic.co/t/impact-of-cve-2025-68161-on-elasticsearch/384828)
**Author:** [@amolrm](https://discuss.elastic.co/u/amolrm)\ **Replies:** 2\ **Last updated:** [January 30, 2026, 4:13pm UTC](https://discuss.elastic.co/t/impact-of-cve-2025-68161-on-elasticsearch/384828 "2026-01-30T16:13:00Z")
hi, Is any version of Elaticsearch impacted by CVE-2025-68161 ? Thank you. --- ## [Elatic fleet custom fields to Elastic Defend](https://discuss.elastic.co/t/elatic-fleet-custom-fields-to-elastic-defend/384794)
**Author:** [@GyciakasGh0st](https://discuss.elastic.co/u/GyciakasGh0st)\ **Replies:** 1\ **Last updated:** [January 29, 2026, 1:26pm UTC](https://discuss.elastic.co/t/elatic-fleet-custom-fields-to-elastic-defend/384794 "2026-01-29T13:26:57Z")
Hi, I have the issue. For my elastic fleet policy in settings i seted two custom fields. For all other integrations documents these fields appearing during ingest. But only for elastic defend these two custom fields … --- ## [Alerting during Penetration tests?](https://discuss.elastic.co/t/alerting-during-penetration-tests/384718)
**Author:** [@Gloom](https://discuss.elastic.co/u/Gloom)\ **Replies:** 0\ **Last updated:** [January 23, 2026, 2:28pm UTC](https://discuss.elastic.co/t/alerting-during-penetration-tests/384718 "2026-01-23T14:28:31Z")
Is there anyway for all alerts generated by a list of hosts / ips / users to all be added to one case automatically? The idea being that during a pentest we don’t want to have to triage the alerts at that time, but don’t… --- ## [\[Custom API\] Integration via GUI](https://discuss.elastic.co/t/custom-api-integration-via-gui/384707)
**Author:** [@kulisiber](https://discuss.elastic.co/u/kulisiber)\ **Replies:** 0\ **Last updated:** [January 23, 2026, 8:50am UTC](https://discuss.elastic.co/t/custom-api-integration-via-gui/384707 "2026-01-23T08:50:37Z")
Hello community team, I am a newbie in elastic, and now I used elastic for security for SIEM in my company. I am confused to setting Custom Integration - Custom API via GUI, can you give me some example for format data… --- ## [Ad-hoc antivirus scan](https://discuss.elastic.co/t/ad-hoc-antivirus-scan/384575)
**Author:** [@i.raisr](https://discuss.elastic.co/u/i.raisr)\ **Replies:** 1\ **Last updated:** [January 16, 2026, 2:24pm UTC](https://discuss.elastic.co/t/ad-hoc-antivirus-scan/384575 "2026-01-16T14:24:30Z")
Dear, Please could you suggest an efficient approach of using Elastic EDR for ad-hoc file antivirus/malware scanning. We would like to integrate our existing Elastic Security platform with the Document Management System… --- ## [Impact of CVE-2025-46295](https://discuss.elastic.co/t/impact-of-cve-2025-46295/384442)
**Author:** [@Max-KI](https://discuss.elastic.co/u/Max-KI)\ **Replies:** 0\ **Last updated:** [January 8, 2026, 2:40pm UTC](https://discuss.elastic.co/t/impact-of-cve-2025-46295/384442 "2026-01-08T14:40:49Z")
CVE-2025-46295 I just downloaded elastic-9.2.3 for Windows. Our security scanner is flagging it because commons-text-1.4.jar is found in the directory elasticsearch-9.2.3\\modules\\x-pack-inference, and CVE-2025-46295 has … --- ## [How often does Elastic Defend integration auto update signatures](https://discuss.elastic.co/t/how-often-does-elastic-defend-integration-auto-update-signatures/384370)
**Author:** [@etrevino-lumificyber](https://discuss.elastic.co/u/etrevino-lumificyber)\ **Replies:** 1\ **Last updated:** [January 5, 2026, 4:29pm UTC](https://discuss.elastic.co/t/how-often-does-elastic-defend-integration-auto-update-signatures/384370 "2026-01-05T16:29:34Z")
Regarding elastic defend integration auto updates. How frequently do these auto updates occur? How frequently are new threat detections updated? --- ## [CVE-2025-66516](https://discuss.elastic.co/t/cve-2025-66516/384111)
**Author:** [@satyam\_mishra](https://discuss.elastic.co/u/satyam_mishra)\ **Replies:** 2\ **Last updated:** [December 17, 2025, 4:09pm UTC](https://discuss.elastic.co/t/cve-2025-66516/384111 "2025-12-17T16:09:40Z")
Is elasticsearch impacted by CVE-2025-66516 any version ? --- ## [Using Kibana Spaces to Enable Multi-Tenancy](https://discuss.elastic.co/t/using-kibana-spaces-to-enable-multi-tenancy/383762)
**Author:** [@RedneckHutch](https://discuss.elastic.co/u/RedneckHutch)\ **Replies:** 1\ **Last updated:** [December 12, 2025, 11:59am UTC](https://discuss.elastic.co/t/using-kibana-spaces-to-enable-multi-tenancy/383762 "2025-12-12T11:59:36Z")
Hey all, We’re working on strengthening our Elastic deployment to better support a multi-tenant environment. Today, we’re handling multi-tenancy by using separate namespaces within agent policies in Fleet, which allows … [Previous page](https://discuss.elastic.co/c/security/83.md?page=1) [Next page](https://discuss.elastic.co/c/security/83.md?page=3)