# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=20 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 21 --- ## [Turn on Anonymous access](https://discuss.elastic.co/t/turn-on-anonymous-access/343822)
**Author:** [@gabrielpicagevicz](https://discuss.elastic.co/u/gabrielpicagevicz)\ **Replies:** 4\ **Last updated:** [October 3, 2023, 12:19am UTC](https://discuss.elastic.co/t/turn-on-anonymous-access/343822 "2023-10-03T00:19:46Z")
I currently have version 8.9.1 of Kibana (basic license) installed on my machine. I created an anonymous user with full access to testing I've added the following to Elasticsearch.yml xpack.security.authc: anonymous:… --- ## [Threat Intelligence Integration won't show any data](https://discuss.elastic.co/t/threat-intelligence-integration-wont-show-any-data/343541)
**Author:** [@Gio\_27](https://discuss.elastic.co/u/Gio_27)\ **Replies:** 7\ **Last updated:** [September 27, 2023, 9:47am UTC](https://discuss.elastic.co/t/threat-intelligence-integration-wont-show-any-data/343541 "2023-09-27T09:47:23Z")
Good morning, I have installed the Threat Intelligence Integration, I also have a fleet managed server and I am currently tracking different hosts with different integrations and i am managing all of that through 2 agen… --- ## [Aggregate Logs based on Source IP](https://discuss.elastic.co/t/aggregate-logs-based-on-source-ip/343789)
**Author:** [@maof97](https://discuss.elastic.co/u/maof97)\ **Replies:** 0\ **Last updated:** [September 25, 2023, 4:16pm UTC](https://discuss.elastic.co/t/aggregate-logs-based-on-source-ip/343789 "2023-09-25T16:16:26Z")
Hello, I'm collecting firewall logs from a firewall (PfSense). On every log record, among other details, I have destination ip addresses and destination ports. Now, I need to have an aggregated list of all destination… --- ## [Error when clicking View Details for alert](https://discuss.elastic.co/t/error-when-clicking-view-details-for-alert/343773)
**Author:** [@val722](https://discuss.elastic.co/u/val722)\ **Replies:** 4\ **Last updated:** [September 25, 2023, 3:41pm UTC](https://discuss.elastic.co/t/error-when-clicking-view-details-for-alert/343773 "2023-09-25T15:41:58Z")
Hello I created a custom threshold detection rule and I get this error in Kibana when I click View details for the alert generated by that rule Error Error: Object.hasOwn is not a function o/\<@http://192.168.56.130:560… --- ## [Sophos integration with elastic agent v 8.9.1](https://discuss.elastic.co/t/sophos-integration-with-elastic-agent-v-8-9-1/341953)
**Author:** [@Ahmad\_Shrateh](https://discuss.elastic.co/u/Ahmad_Shrateh)\ **Replies:** 1\ **Last updated:** [September 25, 2023, 7:21am UTC](https://discuss.elastic.co/t/sophos-integration-with-elastic-agent-v-8-9-1/341953 "2023-09-25T07:21:22Z")
I working on integrating Sophos firewall via UDP --\> screenshot attached I'm receiving the logs perfectly but I had an issue with no correct parsing of the data, and since all the log details are on the same field and t… --- ## [Filter Alerts by data\_stream.namespace](https://discuss.elastic.co/t/filter-alerts-by-data-stream-namespace/343517)
**Author:** [@DVCS](https://discuss.elastic.co/u/DVCS)\ **Replies:** 0\ **Last updated:** [September 21, 2023, 8:56am UTC](https://discuss.elastic.co/t/filter-alerts-by-data-stream-namespace/343517 "2023-09-21T08:56:57Z")
Hi All, I'm trying to filter alerts with KQL using "data\_stream.namespace" in Security -\> Alerts but no results. Even using "Group alerts by" with "data\_stream.namespace" gives no result. But the field is visible and … --- ## [The issue in a detection rule](https://discuss.elastic.co/t/the-issue-in-a-detection-rule/343448)
**Author:** [@saudmajed99](https://discuss.elastic.co/u/saudmajed99)\ **Replies:** 2\ **Last updated:** [September 20, 2023, 2:14pm UTC](https://discuss.elastic.co/t/the-issue-in-a-detection-rule/343448 "2023-09-20T14:14:08Z")
Hi there, We would like your support, we face an issue if we create a detection rule where no result appears but results appears when we do the same search in the discover side , please assist me the solving an issue wi… --- ## [CVE-2022-1471 Still Applicable in latest 7.\* and 8. \*, not listed on Security Issues Page](https://discuss.elastic.co/t/cve-2022-1471-still-applicable-in-latest-7-and-8-not-listed-on-security-issues-page/342965)
**Author:** [@aduerr](https://discuss.elastic.co/u/aduerr)\ **Replies:** 3\ **Last updated:** [September 14, 2023, 12:35pm UTC](https://discuss.elastic.co/t/cve-2022-1471-still-applicable-in-latest-7-and-8-not-listed-on-security-issues-page/342965 "2023-09-14T12:35:53Z")
The latest versions of 7.\* and 8.\* in the Elasticsearch image still contain CRITICAL security vulnerability for CVE-2022-1471, snakeyaml. When is this going to be addressed? Are there suggested workarounds or mitigatio… --- ## [Get base events triggered by a threshold rule](https://discuss.elastic.co/t/get-base-events-triggered-by-a-threshold-rule/343034)
**Author:** [@c8n](https://discuss.elastic.co/u/c8n)\ **Replies:** 0\ **Last updated:** [September 14, 2023, 9:35am UTC](https://discuss.elastic.co/t/get-base-events-triggered-by-a-threshold-rule/343034 "2023-09-14T09:35:09Z")
I'm having a hard time trying to get the base events that triggered a threshold rule using a logstash pipeline. Right now I've built a KQL query that gives those documents, but still doesnt populate any field in the orig… --- ## [Elastic Defend - Credential Harderning](https://discuss.elastic.co/t/elastic-defend-credential-harderning/342858)
**Author:** [@slash24](https://discuss.elastic.co/u/slash24)\ **Replies:** 1\ **Last updated:** [September 12, 2023, 6:29pm UTC](https://discuss.elastic.co/t/elastic-defend-credential-harderning/342858 "2023-09-12T18:29:07Z")
What does the "Credential hardening"-setting in Elastic Defend-integration do for Windows-endpoints when active? Does it simply set the RunasPPL registry key? We have thirdparty components involved in authentication an… --- ## [Issue creating case from Dev Panel](https://discuss.elastic.co/t/issue-creating-case-from-dev-panel/341718)
**Author:** [@AceVla](https://discuss.elastic.co/u/AceVla)\ **Replies:** 16\ **Last updated:** [September 12, 2023, 6:19pm UTC](https://discuss.elastic.co/t/issue-creating-case-from-dev-panel/341718 "2023-09-12T18:19:08Z")
We are creating a case in the dev panel in Elastic, here is the code: POST api/cases { "description": "A case description.", "title": "Case title 1", "tags": \[ "tag 1" \], "connector": { "id": "none", "na… --- ## [Support for Osquery's Carves Table in Upcoming Roadmap?](https://discuss.elastic.co/t/support-for-osquerys-carves-table-in-upcoming-roadmap/342874)
**Author:** [@Bearloggs](https://discuss.elastic.co/u/Bearloggs)\ **Replies:** 0\ **Last updated:** [September 12, 2023, 4:59pm UTC](https://discuss.elastic.co/t/support-for-osquerys-carves-table-in-upcoming-roadmap/342874 "2023-09-12T16:59:09Z")
Hello, I've been exploring the integration of osquery with Elastic and was curious about a specific feature – the support for osquery's "carves table". The ability to use the carves table for file pulling can be incred… --- ## [Metricbeat unable to insert data after upgrade from 7 to 8](https://discuss.elastic.co/t/metricbeat-unable-to-insert-data-after-upgrade-from-7-to-8/342859)
**Author:** [@Claude\_Brassel](https://discuss.elastic.co/u/Claude_Brassel)\ **Replies:** 0\ **Last updated:** [September 12, 2023, 2:52pm UTC](https://discuss.elastic.co/t/metricbeat-unable-to-insert-data-after-upgrade-from-7-to-8/342859 "2023-09-12T14:52:24Z")
Hello, I have upgraded my elk cluster from 7.17 to 8.10, everything is fine but metricbeat seem's unable to insert new data : (status=403): {"type":"security\_exception","reason":"action \[indices:admin/mapping/auto\_put\]… --- ## [Custom Machine Learning Model on Elastic Security](https://discuss.elastic.co/t/custom-machine-learning-model-on-elastic-security/341862)
**Author:** [@xynobob](https://discuss.elastic.co/u/xynobob)\ **Replies:** 3\ **Last updated:** [September 12, 2023, 10:38am UTC](https://discuss.elastic.co/t/custom-machine-learning-model-on-elastic-security/341862 "2023-09-12T10:38:52Z")
Hi, I am doing a small side project and this is my first time diving into Elastic Security. Read several documentations, however it doesn't clarify my doubt, so am asking here instead. So my question is - Is it possible… --- ## [Alert when Log Source last event received is \< 24 Hours](https://discuss.elastic.co/t/alert-when-log-source-last-event-received-is-24-hours/342665)
**Author:** [@Shinej](https://discuss.elastic.co/u/Shinej)\ **Replies:** 1\ **Last updated:** [September 9, 2023, 9:40pm UTC](https://discuss.elastic.co/t/alert-when-log-source-last-event-received-is-24-hours/342665 "2023-09-09T21:40:50Z")
Hello All, Im trying create an alert when when Log Source last event received is \< 24 Hours OR a dashboard which displays log Source which is not sending logs since last 24 hours. I was able to build a dashboard with l… --- ## [Multi-value lists for elk rule](https://discuss.elastic.co/t/multi-value-lists-for-elk-rule/342579)
**Author:** [@Poukim0m](https://discuss.elastic.co/u/Poukim0m)\ **Replies:** 0\ **Last updated:** [September 8, 2023, 7:16am UTC](https://discuss.elastic.co/t/multi-value-lists-for-elk-rule/342579 "2023-09-08T07:16:27Z")
Do you know how to implement the functionality of lists (for the purpose of exclusion/whitelisting) that contain multiple (two or more) fields (values) in each entry? For example i need to have a list with the combinati… --- ## [Alert Rule Not showing on Secuirty Dashboard but is rule is active and creating alerts](https://discuss.elastic.co/t/alert-rule-not-showing-on-secuirty-dashboard-but-is-rule-is-active-and-creating-alerts/342504)
**Author:** [@geekzy](https://discuss.elastic.co/u/geekzy)\ **Replies:** 1\ **Last updated:** [September 7, 2023, 3:13pm UTC](https://discuss.elastic.co/t/alert-rule-not-showing-on-secuirty-dashboard-but-is-rule-is-active-and-creating-alerts/342504 "2023-09-07T15:13:10Z")
We have been experiencing some on going issues since we have upgraded to 8.9.1 from 7.17.11. Primarily all our issues have been with Kibana's Security SIEM. There are two main issues that we have been experiencing: Ce… --- ## [Failed to load BPF probes](https://discuss.elastic.co/t/failed-to-load-bpf-probes/339667)
**Author:** [@L1NG](https://discuss.elastic.co/u/L1NG)\ **Replies:** 9\ **Last updated:** [September 6, 2023, 6:28pm UTC](https://discuss.elastic.co/t/failed-to-load-bpf-probes/339667 "2023-09-06T18:28:10Z")
Hello, does anyone know how to resolve this issue? My kernel version is 6.4.5-1. el7.elrepo.x86\_ 64, the k8s version is v1.23.6, the system is CentOS Linux 7 (Core), and the Docker version is 24.0.5 state: 3 message: 1… --- ## [Authentication failed for an OpenID integration(oidc)](https://discuss.elastic.co/t/authentication-failed-for-an-openid-integration-oidc/342330)
**Author:** [@EdricStrongshield](https://discuss.elastic.co/u/EdricStrongshield)\ **Replies:** 0\ **Last updated:** [September 5, 2023, 10:15am UTC](https://discuss.elastic.co/t/authentication-failed-for-an-openid-integration-oidc/342330 "2023-09-05T10:15:28Z")
Hello,I have a question about authentication that I need your help with. My software version is 8.5 Error: \[o.e.x.s.a.RealmsAuthenticator\] \[node-1\] Authentication to realm oidc1 failed - Failed to authenticate user wit… --- ## [Configuring LDAP](https://discuss.elastic.co/t/configuring-ldap/342312)
**Author:** [@elk\_beginner](https://discuss.elastic.co/u/elk_beginner)\ **Replies:** 1\ **Last updated:** [September 5, 2023, 9:06am UTC](https://discuss.elastic.co/t/configuring-ldap/342312 "2023-09-05T09:06:06Z")
Hi, I am trying to configure LDAP authentication, but I have some trouble. I have this logs. P.S. I just begin to work with ELK, so I don’t know much \[node-1\] license \[...\] mode \[basic\] - valid \[node-1\] license mode i… --- ## [Can i configure Mikrotik Router in Elastic ELK?](https://discuss.elastic.co/t/can-i-configure-mikrotik-router-in-elastic-elk/341227)
**Author:** [@Heetav](https://discuss.elastic.co/u/Heetav)\ **Replies:** 0\ **Last updated:** [August 21, 2023, 11:01am UTC](https://discuss.elastic.co/t/can-i-configure-mikrotik-router-in-elastic-elk/341227 "2023-08-21T11:01:06Z")
Hi, We are using Elastic ELK with Kibana version. If there any way that I can configure Mikrotik Router in SIEM/SOC operations ? --- ## [URL shortening services monitoring via ELK](https://discuss.elastic.co/t/url-shortening-services-monitoring-via-elk/341911)
**Author:** [@Ragul\_venkatasubban](https://discuss.elastic.co/u/Ragul_venkatasubban)\ **Replies:** 0\ **Last updated:** [August 29, 2023, 4:05pm UTC](https://discuss.elastic.co/t/url-shortening-services-monitoring-via-elk/341911 "2023-08-29T16:05:42Z")
Hey, I have integrated firewall logs in ELK. I came across some logs which are of URL shorteners eg., bit\[.\]ly, etc.. the interesting part is when a user clicks on these kinds of URLs we won't know the original URL and … --- ## [MISP integration no data](https://discuss.elastic.co/t/misp-integration-no-data/341190)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 5\ **Last updated:** [August 24, 2023, 8:37am UTC](https://discuss.elastic.co/t/misp-integration-no-data/341190 "2023-08-24T08:37:10Z")
Good day, Setup a MISP server and trying to ingest data with MISP integration but there is no data coming into elastic. Got the right authkey and no restrictions on the MISP Server firewall. Also able to get data when r… --- ## [Elastic agent unhealthy because of elastic defend integration](https://discuss.elastic.co/t/elastic-agent-unhealthy-because-of-elastic-defend-integration/340874)
**Author:** [@laale1](https://discuss.elastic.co/u/laale1)\ **Replies:** 5\ **Last updated:** [August 26, 2023, 9:12am UTC](https://discuss.elastic.co/t/elastic-agent-unhealthy-because-of-elastic-defend-integration/340874 "2023-08-26T09:12:38Z")
Hello community I'm having an issue in my elastic agent, I installed the agent in windows and Linux machines is working well and I can get the event logs and syslog, however when I try to add elastic defend integration t… --- ## [Blocklist not working as expected](https://discuss.elastic.co/t/blocklist-not-working-as-expected/341465)
**Author:** [@Krishna\_Teja](https://discuss.elastic.co/u/Krishna_Teja)\ **Replies:** 2\ **Last updated:** [August 24, 2023, 2:10am UTC](https://discuss.elastic.co/t/blocklist-not-working-as-expected/341465 "2023-08-24T02:10:47Z")
I added an application to blocklist. Ensured malware protections and blocklist are enabled for the policy. Even after hours of adding, I'm still able to run the application. --- ## [Elastic agent upgrade 8.7.1 failed](https://discuss.elastic.co/t/elastic-agent-upgrade-8-7-1-failed/341169)
**Author:** [@xqaiviwjxzw](https://discuss.elastic.co/u/xqaiviwjxzw)\ **Replies:** 2\ **Last updated:** [August 22, 2023, 3:40pm UTC](https://discuss.elastic.co/t/elastic-agent-upgrade-8-7-1-failed/341169 "2023-08-22T15:40:04Z")
Hello ,When I upgraded the elastic agent from 8.5.2 to 8.7.1, the following error occurred, and I have been unable to upgrade to 8.7.1. What is the solution? message: "component gateway-8da30c24: failed to dispatch acti… --- ## [Threshold detection rule - limitation of group by fields](https://discuss.elastic.co/t/threshold-detection-rule-limitation-of-group-by-fields/338383)
**Author:** [@Poukim0m](https://discuss.elastic.co/u/Poukim0m)\ **Replies:** 3\ **Last updated:** [August 22, 2023, 1:51pm UTC](https://discuss.elastic.co/t/threshold-detection-rule-limitation-of-group-by-fields/338383 "2023-08-22T13:51:54Z")
Hello, I want to implement a threshold detection rule that aggregates more than 3 fields in the "Group by" section of rule definition. But there seems to be a limitation of 3 fields as i get an error message "Number of … --- ## [Data is being shown sometimes without access](https://discuss.elastic.co/t/data-is-being-shown-sometimes-without-access/340968)
**Author:** [@Amol\_Gaitonde1](https://discuss.elastic.co/u/Amol_Gaitonde1)\ **Replies:** 2\ **Last updated:** [August 21, 2023, 5:57pm UTC](https://discuss.elastic.co/t/data-is-being-shown-sometimes-without-access/340968 "2023-08-21T17:57:39Z")
We are on elastic version 8.8.1, build\_flavor is default and build\_type is docker. We have created an user test\_user with role role\_1 which has access to index\_1 and no other index. We are noticing a security issue that… --- ## [Elastic defend certificate error on windows when connecting to ES](https://discuss.elastic.co/t/elastic-defend-certificate-error-on-windows-when-connecting-to-es/341161)
**Author:** [@pushou](https://discuss.elastic.co/u/pushou)\ **Replies:** 2\ **Last updated:** [August 21, 2023, 5:53pm UTC](https://discuss.elastic.co/t/elastic-defend-certificate-error-on-windows-when-connecting-to-es/341161 "2023-08-21T17:53:34Z")
Elastic agent is working and was registered with ca.crt file path on windows 2019 server. Elastic defend integration failed to connect to ES with this message:"Elasticsearch connection failure" Looking at logs give me … --- ## [Create a rule or alert to monitor when its not receiving logs by 24 hours?](https://discuss.elastic.co/t/create-a-rule-or-alert-to-monitor-when-its-not-receiving-logs-by-24-hours/340932)
**Author:** [@lucasyuki](https://discuss.elastic.co/u/lucasyuki)\ **Replies:** 1\ **Last updated:** [August 21, 2023, 5:00pm UTC](https://discuss.elastic.co/t/create-a-rule-or-alert-to-monitor-when-its-not-receiving-logs-by-24-hours/340932 "2023-08-21T17:00:37Z")
Hi, I've been trying to check how to create this type of rule in the forum and I saw that other people have the same problem [Previous page](https://discuss.elastic.co/c/security/83.md?page=19) [Next page](https://discuss.elastic.co/c/security/83.md?page=21)