# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=21 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 22 --- ## [Problem between elasticsearch and logstash](https://discuss.elastic.co/t/problem-between-elasticsearch-and-logstash/341206)
**Author:** [@adimi\_worou](https://discuss.elastic.co/u/adimi_worou)\ **Replies:** 0\ **Last updated:** [August 21, 2023, 7:59am UTC](https://discuss.elastic.co/t/problem-between-elasticsearch-and-logstash/341206 "2023-08-21T07:59:49Z")
Good evening, Elasticsearch via logstash loads data from mysql. The problem is that logstash only retrieves a small part of the documents. Example: logstash retrieves 8 out of 510. What do you think could be the cause … --- ## [Error activating rule](https://discuss.elastic.co/t/error-activating-rule/340742)
**Author:** [@saudmajed99](https://discuss.elastic.co/u/saudmajed99)\ **Replies:** 5\ **Last updated:** [August 21, 2023, 6:42am UTC](https://discuss.elastic.co/t/error-activating-rule/340742 "2023-08-21T06:42:13Z")
Hi there, We have faced the issue when activated the rule and the appear this Error Alert type siem.signals is disabled because your basic license has expired My version ELK: 7.17.8 Basic license can you hlep me ? --- ## [Create an API key using a client authenticated by an existing API key](https://discuss.elastic.co/t/create-an-api-key-using-a-client-authenticated-by-an-existing-api-key/341119)
**Author:** [@Jim\_Song](https://discuss.elastic.co/u/Jim_Song)\ **Replies:** 1\ **Last updated:** [August 19, 2023, 5:11am UTC](https://discuss.elastic.co/t/create-an-api-key-using-a-client-authenticated-by-an-existing-api-key/341119 "2023-08-19T05:11:05Z")
I am using an API key to create an elasticsearch client. I am using the client to create another API key but is getting an error. Any idea whether the existing key (or the derived key) needs to be created with certain pr… --- ## [Security alerts not generated for each document](https://discuss.elastic.co/t/security-alerts-not-generated-for-each-document/341049)
**Author:** [@nlcsdev](https://discuss.elastic.co/u/nlcsdev)\ **Replies:** 5\ **Last updated:** [August 18, 2023, 4:00am UTC](https://discuss.elastic.co/t/security-alerts-not-generated-for-each-document/341049 "2023-08-18T04:00:44Z")
I have a processor that sends vulnerability reports to an index, and thousands of documents can be ingested within seconds. I've set up an alert through security using custom query, where the query just filters for docum… --- ## [EQL date difference function](https://discuss.elastic.co/t/eql-date-difference-function/339420)
**Author:** [@j91321](https://discuss.elastic.co/u/j91321)\ **Replies:** 1\ **Last updated:** [August 14, 2023, 4:30pm UTC](https://discuss.elastic.co/t/eql-date-difference-function/339420 "2023-08-14T16:30:27Z")
Is there a way how to get diff of two dates in EQL? I checked the EQL functions docs, but neither subtract() nor number() seem to work on datetime fields. I know I can probably achieve what I need with ingest pipeline or… --- ## [Registering Wasabi as Snapshot repository for ECE cluster](https://discuss.elastic.co/t/registering-wasabi-as-snapshot-repository-for-ece-cluster/339297)
**Author:** [@kkumari](https://discuss.elastic.co/u/kkumari)\ **Replies:** 1\ **Last updated:** [August 14, 2023, 3:47pm UTC](https://discuss.elastic.co/t/registering-wasabi-as-snapshot-repository-for-ece-cluster/339297 "2023-08-14T15:47:04Z")
How do I register Wasabi as Snapshot repository for my ECE cluster? --- ## [Decentralised architecture with elastic SIEM](https://discuss.elastic.co/t/decentralised-architecture-with-elastic-siem/340598)
**Author:** [@kafikone](https://discuss.elastic.co/u/kafikone)\ **Replies:** 1\ **Last updated:** [August 11, 2023, 2:15am UTC](https://discuss.elastic.co/t/decentralised-architecture-with-elastic-siem/340598 "2023-08-11T02:15:07Z")
Hi all I have a concern and I would like to have some leads if possible. I'd like to know if it's possible for elastic agents installed on machines at a company site in town A, for example, to be able to send logs to t… --- ## [Curl: (77) Problem with the SSL CA cert (path? access rights?)](https://discuss.elastic.co/t/curl-77-problem-with-the-ssl-ca-cert-path-access-rights/338761)
**Author:** [@PodarcisMuralis](https://discuss.elastic.co/u/PodarcisMuralis)\ **Replies:** 4\ **Last updated:** [August 10, 2023, 7:39am UTC](https://discuss.elastic.co/t/curl-77-problem-with-the-ssl-ca-cert-path-access-rights/338761 "2023-08-10T07:39:34Z")
Hi, I use a shell script to send curl to elasticsearch. But I got this error: curl: (77) Problem with the SSL CA cert (path? access rights?) My curl is like: RESPONSE=$(curl -v -s -w "%{http\_code}" -o /dev/null -XDEL… --- ## [EQL query to alert 1 alert per each user](https://discuss.elastic.co/t/eql-query-to-alert-1-alert-per-each-user/339539)
**Author:** [@yzaritskyi](https://discuss.elastic.co/u/yzaritskyi)\ **Replies:** 2\ **Last updated:** [August 8, 2023, 1:15pm UTC](https://discuss.elastic.co/t/eql-query-to-alert-1-alert-per-each-user/339539 "2023-08-08T13:15:08Z")
Hello all! I'd like to create a Rule based on the EQL query that will trigger an alert only once per user. For example: The input list of logs is user1 ip1 user1 ip1 user2 ip2 user5 ip5 user4 ip4 user4 ip4 user… --- ## [How to do to show field values in Kibana alert?](https://discuss.elastic.co/t/how-to-do-to-show-field-values-in-kibana-alert/340319)
**Author:** [@aungsoemin](https://discuss.elastic.co/u/aungsoemin)\ **Replies:** 0\ **Last updated:** [August 8, 2023, 4:12am UTC](https://discuss.elastic.co/t/how-to-do-to-show-field-values-in-kibana-alert/340319 "2023-08-08T04:12:38Z")
Hi Everyone, I created the custom rule to get the alert when there is successful login from public IP for Windows host. The lucene query is as per below. (winlog.channel:Security AND winlog.event\_id:4624 AND (NOT ((win… --- ## [Inserting Custom Logs Into Siem](https://discuss.elastic.co/t/inserting-custom-logs-into-siem/340092)
**Author:** [@Nishant\_Chauhan](https://discuss.elastic.co/u/Nishant_Chauhan)\ **Replies:** 0\ **Last updated:** [August 4, 2023, 3:35am UTC](https://discuss.elastic.co/t/inserting-custom-logs-into-siem/340092 "2023-08-04T03:35:16Z")
Hi @cwurm, Referring to this topic - Inserting Custom Logs Into Siem I am using Custom Log Integration, using everything as default , I only added custom pattern for below logs. 2023-07-25T08:05:25.661Z ERRO 1 --- \[… --- ## [What's the competitive advantage of elastic security v.s. existing security platforms?](https://discuss.elastic.co/t/whats-the-competitive-advantage-of-elastic-security-v-s-existing-security-platforms/339806)
**Author:** [@Ernest\_Dong](https://discuss.elastic.co/u/Ernest_Dong)\ **Replies:** 5\ **Last updated:** [August 3, 2023, 2:42pm UTC](https://discuss.elastic.co/t/whats-the-competitive-advantage-of-elastic-security-v-s-existing-security-platforms/339806 "2023-08-03T14:42:44Z")
What's the unique value elastic security provides? Is it SIEM? Why do people use elastic for XDR instead of crowdstrike and so on, since they can provide network solutions etc. --- ## [Correlating two log source in elastic security](https://discuss.elastic.co/t/correlating-two-log-source-in-elastic-security/339994)
**Author:** [@Kliwon\_Zervaloski](https://discuss.elastic.co/u/Kliwon_Zervaloski)\ **Replies:** 1\ **Last updated:** [August 3, 2023, 2:18pm UTC](https://discuss.elastic.co/t/correlating-two-log-source-in-elastic-security/339994 "2023-08-03T14:18:41Z")
I struggle on correlating log from two source in my case. So basically, I want make correlation even with sequence or not, in firewall and endpoint security data source. But some reference I've read are not solved my pro… --- ## [Elastic Security - Host No longer logging Alert](https://discuss.elastic.co/t/elastic-security-host-no-longer-logging-alert/340043)
**Author:** [@g.spasov](https://discuss.elastic.co/u/g.spasov)\ **Replies:** 0\ **Last updated:** [August 3, 2023, 12:22pm UTC](https://discuss.elastic.co/t/elastic-security-host-no-longer-logging-alert/340043 "2023-08-03T12:22:58Z")
Hello, I want to create a detection rule in Elastic Security that would trigger when no logs have been injested to Elastic for more than 24 hours from a particular host.name. The idea is to detect potential logging pro… --- ## [Detection Rule During Specific Hours](https://discuss.elastic.co/t/detection-rule-during-specific-hours/338493)
**Author:** [@SomeRobot](https://discuss.elastic.co/u/SomeRobot)\ **Replies:** 3\ **Last updated:** [August 3, 2023, 3:24am UTC](https://discuss.elastic.co/t/detection-rule-during-specific-hours/338493 "2023-08-03T03:24:54Z")
We need to write a detection rule that only looks for matches between specific hours of the day, say 12AM - 4AM EST. I assume there is a way to do this, because it would be a huge oversight if there wasn't, but I can't s… --- ## [How to create a complex detection rule (indicator + correlation)?](https://discuss.elastic.co/t/how-to-create-a-complex-detection-rule-indicator-correlation/337249)
**Author:** [@VellayLoket](https://discuss.elastic.co/u/VellayLoket)\ **Replies:** 7\ **Last updated:** [August 3, 2023, 2:07am UTC](https://discuss.elastic.co/t/how-to-create-a-complex-detection-rule-indicator-correlation/337249 "2023-08-03T02:07:04Z")
For example, i have list with malware domains. I save logs from my DNS servers. I want to create alert when any client of my network has request for malware domain name. And with this, i need to aggregate this request… --- ## [Index keeps getting deleted and new index created called read-me-to-recover-data is created](https://discuss.elastic.co/t/index-keeps-getting-deleted-and-new-index-created-called-read-me-to-recover-data-is-created/339882)
**Author:** [@AndyX](https://discuss.elastic.co/u/AndyX)\ **Replies:** 5\ **Last updated:** [August 2, 2023, 4:06pm UTC](https://discuss.elastic.co/t/index-keeps-getting-deleted-and-new-index-created-called-read-me-to-recover-data-is-created/339882 "2023-08-02T16:06:47Z")
Every few days my Elasticsearch index gets deleted. I assume this is due to me running with the following: xpack.security.enabled: false When my index is deleted a new index with the name: read-me-to-recover-data is … --- ## [Get logs from remote devices](https://discuss.elastic.co/t/get-logs-from-remote-devices/339292)
**Author:** [@Siddharth\_Jain1](https://discuss.elastic.co/u/Siddharth_Jain1)\ **Replies:** 3\ **Last updated:** [July 28, 2023, 12:54am UTC](https://discuss.elastic.co/t/get-logs-from-remote-devices/339292 "2023-07-28T00:54:10Z")
We have 1500+ remote hosts( MAC, ubuntu, Windows) laptops, which are not in our network 24x7. I want to fetch logs from these devices even if they are not connected to our VPN. Is there any way through which we can achie… --- ## [Threshold Alerts with Delayed Logs - Verification](https://discuss.elastic.co/t/threshold-alerts-with-delayed-logs-verification/338362)
**Author:** [@kbratt](https://discuss.elastic.co/u/kbratt)\ **Replies:** 2\ **Last updated:** [July 27, 2023, 3:53pm UTC](https://discuss.elastic.co/t/threshold-alerts-with-delayed-logs-verification/338362 "2023-07-27T15:53:18Z")
I have set up Threshold Security Alerts that are running every 5 minutes and looking back an additional 1 minute.. We are working on fixing a performance issue where our Logs are delayed by up to 20 minutes at times. S… --- ## [Elastic Endpoint Integration - Large amount of Log data ingested](https://discuss.elastic.co/t/elastic-endpoint-integration-large-amount-of-log-data-ingested/339201)
**Author:** [@Seas39](https://discuss.elastic.co/u/Seas39)\ **Replies:** 6\ **Last updated:** [July 27, 2023, 11:59am UTC](https://discuss.elastic.co/t/elastic-endpoint-integration-large-amount-of-log-data-ingested/339201 "2023-07-27T11:59:32Z")
Hi, I have been trialing using elastic cloud for the purpose of EDR tooling on some linux systems. I have been using elastic endpoint on two environments with the hope of later scaling, currently, having run for two wee… --- ## [How to create a Security Rule (SIEM) for Custom Logs Integration](https://discuss.elastic.co/t/how-to-create-a-security-rule-siem-for-custom-logs-integration/339327)
**Author:** [@Nishant\_Chauhan](https://discuss.elastic.co/u/Nishant_Chauhan)\ **Replies:** 0\ **Last updated:** [July 26, 2023, 3:51pm UTC](https://discuss.elastic.co/t/how-to-create-a-security-rule-siem-for-custom-logs-integration/339327 "2023-07-26T15:51:29Z")
Hi Team, I have setup Custom Logs Integration and able to create rules for observability. but rules are not working for Security dashboard. sample log 2023-07-26T08:05:25.661Z ERRO 1 --- \[nio-8080-exec-3\] c.i.c.b.c.H… --- ## [Alert when winlogbeat host stop sending events](https://discuss.elastic.co/t/alert-when-winlogbeat-host-stop-sending-events/339141)
**Author:** [@vladislav](https://discuss.elastic.co/u/vladislav)\ **Replies:** 3\ **Last updated:** [July 25, 2023, 2:47pm UTC](https://discuss.elastic.co/t/alert-when-winlogbeat-host-stop-sending-events/339141 "2023-07-25T14:47:04Z")
Hello and thanks in advance. I have a group of 100+ hosts with winlogbeat installed and sending events to elasticsearch cluster. Is there any options to generate an alert (on security or any other page) when one or gro… --- ## [Unable to start elasticsearch when configuring SSL](https://discuss.elastic.co/t/unable-to-start-elasticsearch-when-configuring-ssl/339030)
**Author:** [@Ryaninsolencee](https://discuss.elastic.co/u/Ryaninsolencee)\ **Replies:** 6\ **Last updated:** [July 25, 2023, 2:07am UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-when-configuring-ssl/339030 "2023-07-25T02:07:48Z")
Very new to ELK stack and ive been trying to tinker and figure out security configs , i already have kibana running on ssl and now im trying to configure elasticsearch. ive followed the guide and now it just refuses to s… --- ## [Will KSPM and CSPM be compatible with Alibaba Cloud in the future?](https://discuss.elastic.co/t/will-kspm-and-cspm-be-compatible-with-alibaba-cloud-in-the-future/337499)
**Author:** [@L1NG](https://discuss.elastic.co/u/L1NG)\ **Replies:** 1\ **Last updated:** [July 24, 2023, 4:04pm UTC](https://discuss.elastic.co/t/will-kspm-and-cspm-be-compatible-with-alibaba-cloud-in-the-future/337499 "2023-07-24T16:04:46Z")
Will KSPM and CSPM be compatible with Alibaba Cloud in the future? --- ## [Alert Suppression on Event Correlation Rule (duplicate alerts)](https://discuss.elastic.co/t/alert-suppression-on-event-correlation-rule-duplicate-alerts/338837)
**Author:** [@adub08](https://discuss.elastic.co/u/adub08)\ **Replies:** 1\ **Last updated:** [July 24, 2023, 3:30pm UTC](https://discuss.elastic.co/t/alert-suppression-on-event-correlation-rule-duplicate-alerts/338837 "2023-07-24T15:30:27Z")
Has anyone found a good way of modifying the prebuilt in event coloration rules Elastic Security to not produce too many alerts repeated alerts within a short time span? Similar to how Alert suppression works with custom… --- ## [Problem connecting Case Management Webhook Integration with Connectwise](https://discuss.elastic.co/t/problem-connecting-case-management-webhook-integration-with-connectwise/337575)
**Author:** [@Rohit\_Kumbhar](https://discuss.elastic.co/u/Rohit_Kumbhar)\ **Replies:** 1\ **Last updated:** [July 21, 2023, 1:10pm UTC](https://discuss.elastic.co/t/problem-connecting-case-management-webhook-integration-with-connectwise/337575 "2023-07-21T13:10:08Z")
Hi Elastic Team, I am Integrating Elastic Case Management with Connectwise Tickets. I have a problem updating the Status and Severity from Elastic Case to Connectwise Ticket. for Initialdescription and title we have {… --- ## [Linux agent system hang / disk IO stall](https://discuss.elastic.co/t/linux-agent-system-hang-disk-io-stall/338873)
**Author:** [@Florian\_Heigl](https://discuss.elastic.co/u/Florian_Heigl)\ **Replies:** 4\ **Last updated:** [July 20, 2023, 11:40pm UTC](https://discuss.elastic.co/t/linux-agent-system-hang-disk-io-stall/338873 "2023-07-20T23:40:43Z")
Hi, I'm seeing an issue with two systems that cease functioning after a while if the agent is active. I've watched it happen for 2-3 months now, and gone through some tests like disabling prevention for one of them. I… --- ## [Elastic Defend Missing Logs](https://discuss.elastic.co/t/elastic-defend-missing-logs/337805)
**Author:** [@infernalz2](https://discuss.elastic.co/u/infernalz2)\ **Replies:** 1\ **Last updated:** [July 17, 2023, 6:20pm UTC](https://discuss.elastic.co/t/elastic-defend-missing-logs/337805 "2023-07-17T18:20:46Z")
Hi guys I am running Elastic Defend 8.7.1 on multiple Ubuntu 20.04.5 and CentOS 7 vms. In both cases network logs from outbound connections are missing (logged user or services), there are only for inbound. To my unders… --- ## [1Password Rule Vault Accessed - Desktop app](https://discuss.elastic.co/t/1password-rule-vault-accessed-desktop-app/336774)
**Author:** [@Alex.W](https://discuss.elastic.co/u/Alex.W)\ **Replies:** 1\ **Last updated:** [July 17, 2023, 2:54pm UTC](https://discuss.elastic.co/t/1password-rule-vault-accessed-desktop-app/336774 "2023-07-17T14:54:06Z")
Hello, I have created a rule that alerts on users accessing a sensitive vault within 1Password (web) but this does not appear to fire when accessing the same vault through the desktop app. There are access logs for the… --- ## [How to not show closed alerts in the "Alerts"-Overview?](https://discuss.elastic.co/t/how-to-not-show-closed-alerts-in-the-alerts-overview/336909)
**Author:** [@m-flow](https://discuss.elastic.co/u/m-flow)\ **Replies:** 4\ **Last updated:** [July 17, 2023, 10:36am UTC](https://discuss.elastic.co/t/how-to-not-show-closed-alerts-in-the-alerts-overview/336909 "2023-07-17T10:36:29Z")
Hello everyone, is there a way to suppress "closed" alerts in Kibana's "Alerts" view, when the status of all alerts changed from open to closed? The general filter exists, but is ineffective when no alerts with the sta… [Previous page](https://discuss.elastic.co/c/security/83.md?page=20) [Next page](https://discuss.elastic.co/c/security/83.md?page=22)