# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=22 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 23 --- ## [Alerts Dashboard Showing All Alerts when "Open" alerts are cleared](https://discuss.elastic.co/t/alerts-dashboard-showing-all-alerts-when-open-alerts-are-cleared/338176)
**Author:** [@oloughlinp](https://discuss.elastic.co/u/oloughlinp)\ **Replies:** 2\ **Last updated:** [July 17, 2023, 10:34am UTC](https://discuss.elastic.co/t/alerts-dashboard-showing-all-alerts-when-open-alerts-are-cleared/338176 "2023-07-17T10:34:16Z")
Hi All, We recently upgraded to Kibana 8.8.0 from 8.0. When using the Alerts dashboard under Kibana Security, we typically use the status filter to filter the dashboard to show only "open" alerts, so that our analysts k… --- ## [Elastic Security rule with Index action](https://discuss.elastic.co/t/elastic-security-rule-with-index-action/338508)
**Author:** [@alextd](https://discuss.elastic.co/u/alextd)\ **Replies:** 1\ **Last updated:** [July 17, 2023, 10:32am UTC](https://discuss.elastic.co/t/elastic-security-rule-with-index-action/338508 "2023-07-17T10:32:32Z")
Hello All, I'm new work with Elastic Security. I'm using the Elastic Security basic version and I want to create the detection rule with Index action. My situation is, I created a rule to detect any connect malicious I… --- ## [Whitelisting Elastic Agent](https://discuss.elastic.co/t/whitelisting-elastic-agent/338367)
**Author:** [@SomeRobot](https://discuss.elastic.co/u/SomeRobot)\ **Replies:** 2\ **Last updated:** [July 16, 2023, 10:27pm UTC](https://discuss.elastic.co/t/whitelisting-elastic-agent/338367 "2023-07-16T22:27:54Z")
We have one or two systems that are running an additional AV software due to reasons beyond our teams control. That being said, we want to deploy the Elastic Agent on the system and will be enabling Defend. What paths do… --- ## [Elastic SIEM Detection Rules / Exception Containers / Exception Lists](https://discuss.elastic.co/t/elastic-siem-detection-rules-exception-containers-exception-lists/338390)
**Author:** [@tsigouris007](https://discuss.elastic.co/u/tsigouris007)\ **Replies:** 0\ **Last updated:** [July 14, 2023, 8:45am UTC](https://discuss.elastic.co/t/elastic-siem-detection-rules-exception-containers-exception-lists/338390 "2023-07-14T08:45:53Z")
Hello, I have created a Terraform Provider for the Elastic SIEM components. You can find the Git repo here: https://github.com/tsigouris007/terraform-provider-elastic-siem-detection The provider is also published to t… --- ## [Xpack disable](https://discuss.elastic.co/t/xpack-disable/338350)
**Author:** [@mannoj87](https://discuss.elastic.co/u/mannoj87)\ **Replies:** 4\ **Last updated:** [July 14, 2023, 7:10am UTC](https://discuss.elastic.co/t/xpack-disable/338350 "2023-07-14T07:10:16Z")
ES Version: 7.10.2 Query 1 : If I need to disable xpack I need to make yml changes to make xpack settings to false and restart each nodes ? Query1 My Understanding is : Yes, there is no API call to disable or enable dy… --- ## [Record Who Closes Alert](https://discuss.elastic.co/t/record-who-closes-alert/338254)
**Author:** [@SomeRobot](https://discuss.elastic.co/u/SomeRobot)\ **Replies:** 1\ **Last updated:** [July 13, 2023, 4:29pm UTC](https://discuss.elastic.co/t/record-who-closes-alert/338254 "2023-07-13T16:29:24Z")
Is there a way to record which user has 'closed' an alert in Elastic Security? I read through the audit log documentation, and it doesn't reference this specific topic. Is there any way to log this? --- ## [Installing elastic agent using K8S is not normal](https://discuss.elastic.co/t/installing-elastic-agent-using-k8s-is-not-normal/337064)
**Author:** [@L1NG](https://discuss.elastic.co/u/L1NG)\ **Replies:** 9\ **Last updated:** [July 13, 2023, 2:11am UTC](https://discuss.elastic.co/t/installing-elastic-agent-using-k8s-is-not-normal/337064 "2023-07-13T02:11:26Z")
1.Install the elastic agent using K8S and check if the pod is running. The result is that it is running 2.But it's not normal to see it in Kibana 3.View detailed proxy information, which shows that there is an issue wi… --- ## [Rule Actions Sometimes Don't Fire](https://discuss.elastic.co/t/rule-actions-sometimes-dont-fire/338245)
**Author:** [@SomeRobot](https://discuss.elastic.co/u/SomeRobot)\ **Replies:** 2\ **Last updated:** [July 12, 2023, 5:49pm UTC](https://discuss.elastic.co/t/rule-actions-sometimes-dont-fire/338245 "2023-07-12T17:49:06Z")
We have hundreds of rules created in Elastic Security which we are leveraging as our SIEM, many Elastic created, some are ours. These rules are all configured to perform the same action, which is to send some details to … --- ## [ELK for Ransomware Identification and Mitigation on Virtual Machines](https://discuss.elastic.co/t/elk-for-ransomware-identification-and-mitigation-on-virtual-machines/337350)
**Author:** [@ADUBOAHENE0016](https://discuss.elastic.co/u/ADUBOAHENE0016)\ **Replies:** 4\ **Last updated:** [July 9, 2023, 1:52pm UTC](https://discuss.elastic.co/t/elk-for-ransomware-identification-and-mitigation-on-virtual-machines/337350 "2023-07-09T13:52:25Z")
1.Setting up the ELK stack 2.Virtualbox 3.Forwarding logs from the virtual machine to ELK 4.Constructing rules for ransomware detection 5.Isolation, containment, remediation, recovery continuous improvement and maint… --- ## [Auditbeat vs elastic endpoint for collecting network traffic from server](https://discuss.elastic.co/t/auditbeat-vs-elastic-endpoint-for-collecting-network-traffic-from-server/337253)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 4\ **Last updated:** [July 4, 2023, 1:25am UTC](https://discuss.elastic.co/t/auditbeat-vs-elastic-endpoint-for-collecting-network-traffic-from-server/337253 "2023-07-04T01:25:05Z")
Hi all. I'm trying to migrate from auditbeat to elastic endpoint and most of every module is ok except for the network. I notice that elastic-endpoint connect network traffic a lot less that auditbeat. After some inve… --- ## [Fleet Server 8.8.1 on prems boot issue](https://discuss.elastic.co/t/fleet-server-8-8-1-on-prems-boot-issue/337312)
**Author:** [@johnjohnsp1](https://discuss.elastic.co/u/johnjohnsp1)\ **Replies:** 3\ **Last updated:** [June 30, 2023, 2:08pm UTC](https://discuss.elastic.co/t/fleet-server-8-8-1-on-prems-boot-issue/337312 "2023-06-30T14:08:46Z")
Hi, i have deployed on prems elasticsearch,kibana and fleet (version 8) on a Centos 8 distro, now every time i boot up the server i see the fleet service is up and running, but, once i go to the fleet sheet i see the ag… --- ## [Is SIEM still free as Elastic Security? I cant seem to find the download for it. Anyone?](https://discuss.elastic.co/t/is-siem-still-free-as-elastic-security-i-cant-seem-to-find-the-download-for-it-anyone/337112)
**Author:** [@gabe-elastic](https://discuss.elastic.co/u/gabe-elastic)\ **Replies:** 6\ **Last updated:** [June 30, 2023, 1:39pm UTC](https://discuss.elastic.co/t/is-siem-still-free-as-elastic-security-i-cant-seem-to-find-the-download-for-it-anyone/337112 "2023-06-30T13:39:52Z")
Is SIEM still free as Elastic Security? I cant seem to find the download for it. Anyone? --- ## [Soar in elastic](https://discuss.elastic.co/t/soar-in-elastic/334425)
**Author:** [@searchwithme](https://discuss.elastic.co/u/searchwithme)\ **Replies:** 4\ **Last updated:** [June 27, 2023, 5:25pm UTC](https://discuss.elastic.co/t/soar-in-elastic/334425 "2023-06-27T17:25:21Z")
I understand there is a way to create a case and assign to someone when an alert is triggered. But SOAR means automatic remediation. The documentation says 'Easily automate your team’s security incident response with Ela… --- ## [Preventing/identifying credit card breach in elastic using SIEM](https://discuss.elastic.co/t/preventing-identifying-credit-card-breach-in-elastic-using-siem/337014)
**Author:** [@searchwithme](https://discuss.elastic.co/u/searchwithme)\ **Replies:** 0\ **Last updated:** [June 27, 2023, 3:45pm UTC](https://discuss.elastic.co/t/preventing-identifying-credit-card-breach-in-elastic-using-siem/337014 "2023-06-27T15:45:09Z")
Hi! I see elastic has a rich array of security features (SIEM, security analytics, endpoint detection, etc). Is there a way to identify/detect if credit card details were crawled by hackers for online transactions? Gi… --- ## [Use case exception](https://discuss.elastic.co/t/use-case-exception/336750)
**Author:** [@PerfectSushi](https://discuss.elastic.co/u/PerfectSushi)\ **Replies:** 0\ **Last updated:** [June 23, 2023, 8:52am UTC](https://discuss.elastic.co/t/use-case-exception/336750 "2023-06-23T08:52:29Z")
Dear team, I am currently facing some challenges while attempting to create a correlated use case involving the prebuilt "Whoami Process Activity." The issue arises because we need to make an exception for a previous lo… --- ## [Threshold rule](https://discuss.elastic.co/t/threshold-rule/336528)
**Author:** [@bex](https://discuss.elastic.co/u/bex)\ **Replies:** 1\ **Last updated:** [June 22, 2023, 4:19am UTC](https://discuss.elastic.co/t/threshold-rule/336528 "2023-06-22T04:19:27Z")
Hello everyone I would like to clarify. For example, I am trying to add threshold rule against login failed attempt If user failes more than 4 times, I should get an alert From the picture above, I am grouping by … --- ## [I need help installing and configuring 0365 intergration](https://discuss.elastic.co/t/i-need-help-installing-and-configuring-0365-intergration/336628)
**Author:** [@Frank247](https://discuss.elastic.co/u/Frank247)\ **Replies:** 1\ **Last updated:** [June 21, 2023, 11:53pm UTC](https://discuss.elastic.co/t/i-need-help-installing-and-configuring-0365-intergration/336628 "2023-06-21T23:53:08Z")
Greetings Elastic Gurus, I need help installing and configuring 0365 intergration to forward my organization data into Elastic. I am willing to hire an expect to assist with this effort. Please let me know if you can he… --- ## [Rule for Applocker](https://discuss.elastic.co/t/rule-for-applocker/334299)
**Author:** [@Leitner](https://discuss.elastic.co/u/Leitner)\ **Replies:** 2\ **Last updated:** [June 21, 2023, 11:31am UTC](https://discuss.elastic.co/t/rule-for-applocker/334299 "2023-06-21T11:31:16Z")
Hi, first of all: I'm a newby with Elastic. So sorry for this question. But I just can't get any further. I want to create a rule for MS Applocker. At Analytics - Discover with filter event.code : 8004 and event.provi… --- ## [Rules and connectors](https://discuss.elastic.co/t/rules-and-connectors/336531)
**Author:** [@imaad](https://discuss.elastic.co/u/imaad)\ **Replies:** 0\ **Last updated:** [June 21, 2023, 6:01am UTC](https://discuss.elastic.co/t/rules-and-connectors/336531 "2023-06-21T06:01:56Z")
Hello, I want to create an Alert to monitor a specific pattern error every 4 hours which occurs in the message field. Could not connect to net.tcp: The connection attempt lasted for a time span of TCP error code 10061… --- ## [EQL - Alert when Follow up event doesn't occur](https://discuss.elastic.co/t/eql-alert-when-follow-up-event-doesnt-occur/329917)
**Author:** [@lilow](https://discuss.elastic.co/u/lilow)\ **Replies:** 2\ **Last updated:** [June 20, 2023, 2:38pm UTC](https://discuss.elastic.co/t/eql-alert-when-follow-up-event-doesnt-occur/329917 "2023-06-20T14:38:07Z")
Hey, I'm trying to implement a rule with eql where I only want to get an alert when a follow up event doesn't occur within a certain time frame. Unfortunately it's not really doing what I'm hoping. Is there any way how… --- ## [Elastic prebuilt rules error](https://discuss.elastic.co/t/elastic-prebuilt-rules-error/334086)
**Author:** [@hasan.idriss](https://discuss.elastic.co/u/hasan.idriss)\ **Replies:** 2\ **Last updated:** [June 19, 2023, 6:56pm UTC](https://discuss.elastic.co/t/elastic-prebuilt-rules-error/334086 "2023-06-19T18:56:32Z")
hi guys am facing an issue with all prebuilt rules in Elasticsearch, when I enable the rules it runs with the following error An error occurred during rule execution: message: "verification\_exception Root causes: veri… --- ## [Osquery has results but not displaying them](https://discuss.elastic.co/t/osquery-has-results-but-not-displaying-them/334606)
**Author:** [@meni0n](https://discuss.elastic.co/u/meni0n)\ **Replies:** 2\ **Last updated:** [June 19, 2023, 1:01pm UTC](https://discuss.elastic.co/t/osquery-has-results-but-not-displaying-them/334606 "2023-06-19T13:01:01Z")
I have osquery agent returning results but the result page keeping saying "1 agent has responded, no osquery data has been reported." --- ## [Elastic Defend Integration with Airgapped Package Registry](https://discuss.elastic.co/t/elastic-defend-integration-with-airgapped-package-registry/336314)
**Author:** [@sgehman](https://discuss.elastic.co/u/sgehman)\ **Replies:** 0\ **Last updated:** [June 18, 2023, 9:17pm UTC](https://discuss.elastic.co/t/elastic-defend-integration-with-airgapped-package-registry/336314 "2023-06-18T21:17:12Z")
I am using Andrew Peases Elastic Container Project, and version 8.6.2 for Elasticsearch, Kibana, and the Elastic Agent which serves as my fleet server. This is in an Airgapped environment, and I have followed the Documen… --- ## [Vê logs do IPS do firewall foritgate no Kibana](https://discuss.elastic.co/t/ve-logs-do-ips-do-firewall-foritgate-no-kibana/335908)
**Author:** [@Paulo\_Martins\_de\_Sen](https://discuss.elastic.co/u/Paulo_Martins_de_Sen)\ **Replies:** 4\ **Last updated:** [June 15, 2023, 8:38pm UTC](https://discuss.elastic.co/t/ve-logs-do-ips-do-firewall-foritgate-no-kibana/335908 "2023-06-15T20:38:15Z")
Hello community, I hope everyone is doing well. I have the following scenario, A fortigate(v7) firewall sending the logs to the logstash server and sending the logs back to the elasticsearch server, even calm, I can re… --- ## [Webhook action is sending multiple alerts](https://discuss.elastic.co/t/webhook-action-is-sending-multiple-alerts/336059)
**Author:** [@Daniel\_B](https://discuss.elastic.co/u/Daniel_B)\ **Replies:** 1\ **Last updated:** [June 15, 2023, 4:57pm UTC](https://discuss.elastic.co/t/webhook-action-is-sending-multiple-alerts/336059 "2023-06-15T16:57:09Z")
Hello there, I have few webhook actions set for some security rules and I'm including some fields from {{context.alerts}} in the POST request. However I've noticed that when 2 (probably more ) alerts of the same type oc… --- ## [Security: Machine Learning jobs stop](https://discuss.elastic.co/t/security-machine-learning-jobs-stop/335851)
**Author:** [@hermlam](https://discuss.elastic.co/u/hermlam)\ **Replies:** 1\ **Last updated:** [June 15, 2023, 1:15pm UTC](https://discuss.elastic.co/t/security-machine-learning-jobs-stop/335851 "2023-06-15T13:15:14Z")
Hi, Some ML jobs, provided with the standard rules stop after a while. For example: " \`\`\` Machine learning job(s) are not started: job id: "rare\_destination\_country", job name: "Network Traffic to Rare Destination Coun… --- ## [\[Agent-Netflow\] Anomaly Detect for spikes on coms between 2 IP](https://discuss.elastic.co/t/agent-netflow-anomaly-detect-for-spikes-on-coms-between-2-ip/335542)
**Author:** [@isaqueprofeta](https://discuss.elastic.co/u/isaqueprofeta)\ **Replies:** 5\ **Last updated:** [June 13, 2023, 9:49pm UTC](https://discuss.elastic.co/t/agent-netflow-anomaly-detect-for-spikes-on-coms-between-2-ip/335542 "2023-06-13T21:49:52Z")
Hey everyone, thanks for having me, I'm currently working with Elastic 8.3 using an Agent (Fleet managed) with Netflow Integration. My current goal is to create two ML Jobs for spikes on traffic between 2 IP's, but I … --- ## [Normalizing the Huawei firewall logs](https://discuss.elastic.co/t/normalizing-the-huawei-firewall-logs/335861)
**Author:** [@Imad\_TAMELGHAGHET](https://discuss.elastic.co/u/Imad_TAMELGHAGHET)\ **Replies:** 4\ **Last updated:** [June 13, 2023, 3:07pm UTC](https://discuss.elastic.co/t/normalizing-the-huawei-firewall-logs/335861 "2023-06-13T15:07:58Z")
Hello , I am actually working on a ELK SIEM project, and one of the logs sources i am woking with is a Huawei Firewall .Since Huawei firewall logs have differents formats, I would appreciate some suggestions and insight… --- ## [Error using BulkEditAction\[\] object](https://discuss.elastic.co/t/error-using-bulkeditaction-object/335252)
**Author:** [@M\_S](https://discuss.elastic.co/u/M_S)\ **Replies:** 5\ **Last updated:** [June 8, 2023, 8:59pm UTC](https://discuss.elastic.co/t/error-using-bulkeditaction-object/335252 "2023-06-08T20:59:19Z")
Hi , I am using Elasticsearch - 8.7.1 and I am trying to update my security rules in EDR with a email action in bulk. I have tried the following -- PUT api/detection\_engine/rules/\_bulk\_action { "action": "edit", "edi… --- ## [There is a problem with installing elastic agent 8.7.1 on Windows Server](https://discuss.elastic.co/t/there-is-a-problem-with-installing-elastic-agent-8-7-1-on-windows-server/335517)
**Author:** [@xqaiviwjxzw](https://discuss.elastic.co/u/xqaiviwjxzw)\ **Replies:** 2\ **Last updated:** [June 8, 2023, 9:24am UTC](https://discuss.elastic.co/t/there-is-a-problem-with-installing-elastic-agent-8-7-1-on-windows-server/335517 "2023-06-08T09:24:03Z")
After installing elastic agent 8.7.1 on Windows Server 2016 Standard, there is no file.path related information in the log. What is the reason?Hope to reply and help, thank you. endpoint.log show： "message":"AgentCo… [Previous page](https://discuss.elastic.co/c/security/83.md?page=21) [Next page](https://discuss.elastic.co/c/security/83.md?page=23)