# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=23 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 24 --- ## [Infrarelated query](https://discuss.elastic.co/t/infrarelated-query/335291)
**Author:** [@TECHY\_GEEK](https://discuss.elastic.co/u/TECHY_GEEK)\ **Replies:** 2\ **Last updated:** [June 7, 2023, 7:07am UTC](https://discuss.elastic.co/t/infrarelated-query/335291 "2023-06-07T07:07:58Z")
Hi there! Actually we want to apply SIEM and SOAR in our organization . we have 100+ servers and want to monitor each one of them. so could anyone tell me about how much specifications we required for that. and yes we d… --- ## [Apple M1 Ultra chip computer with elastic agent installed,.Approved Elastic Endpoint's web content filtering, resulting in network disconnection](https://discuss.elastic.co/t/apple-m1-ultra-chip-computer-with-elastic-agent-installed-approved-elastic-endpoints-web-content-filtering-resulting-in-network-disconnection/333739)
**Author:** [@xqaiviwjxzw](https://discuss.elastic.co/u/xqaiviwjxzw)\ **Replies:** 4\ **Last updated:** [June 7, 2023, 6:36am UTC](https://discuss.elastic.co/t/apple-m1-ultra-chip-computer-with-elastic-agent-installed-approved-elastic-endpoints-web-content-filtering-resulting-in-network-disconnection/333739 "2023-06-07T06:36:40Z")
I tried to install resilient agent 8.4.1 and 8.7.1 on a chip:Apple M1 Ultra mac, after approving the network content filtering of the resilient endpoint, the computer was disconnected and could not use the wifi networ… --- ## [How to create sequence rules?](https://discuss.elastic.co/t/how-to-create-sequence-rules/335390)
**Author:** [@VellayLoket](https://discuss.elastic.co/u/VellayLoket)\ **Replies:** 0\ **Last updated:** [June 7, 2023, 4:39am UTC](https://discuss.elastic.co/t/how-to-create-sequence-rules/335390 "2023-06-07T04:39:52Z")
So, i want to create the sequence rules to aggregate the same events to one alert. For example i have event from IDS system where i have fields like: client.ip cs1 - the category name ("malware activity" or smth like … --- ## [Add custom field for action to teams webhook](https://discuss.elastic.co/t/add-custom-field-for-action-to-teams-webhook/334779)
**Author:** [@fontexD](https://discuss.elastic.co/u/fontexD)\ **Replies:** 3\ **Last updated:** [June 6, 2023, 12:58pm UTC](https://discuss.elastic.co/t/add-custom-field-for-action-to-teams-webhook/334779 "2023-06-06T12:58:02Z")
im trying to add a custom field from the table of the event but it dosent pass the value into the teams webhook --- ## [There is a problem with elastic agent pushing logstash](https://discuss.elastic.co/t/there-is-a-problem-with-elastic-agent-pushing-logstash/335265)
**Author:** [@xqaiviwjxzw](https://discuss.elastic.co/u/xqaiviwjxzw)\ **Replies:** 0\ **Last updated:** [June 6, 2023, 4:49am UTC](https://discuss.elastic.co/t/there-is-a-problem-with-elastic-agent-pushing-logstash/335265 "2023-06-06T04:49:20Z")
By changing the original strategy of the elastic agent to push the log to Elasticsearch to push to the new strategy to push to logstash, why the log is still in the original Elasticsearch, but not pushed to the new lo… --- ## [Integration Elastic Security with Microsoft Sentinel available?](https://discuss.elastic.co/t/integration-elastic-security-with-microsoft-sentinel-available/335025)
**Author:** [@Jeronimodus](https://discuss.elastic.co/u/Jeronimodus)\ **Replies:** 6\ **Last updated:** [June 6, 2023, 1:20am UTC](https://discuss.elastic.co/t/integration-elastic-security-with-microsoft-sentinel-available/335025 "2023-06-06T01:20:39Z")
Hello all, I am looking for a way to import alerts and possibly more data from Sentinel into Elastic Security. I do not see an integration available for this. Is there someone who can confirm that this does not exist an… --- ## [Alerts not appearing after 8.5.2 \> 8.8.0 upgrade](https://discuss.elastic.co/t/alerts-not-appearing-after-8-5-2-8-8-0-upgrade/335136)
**Author:** [@bfarren240](https://discuss.elastic.co/u/bfarren240)\ **Replies:** 0\ **Last updated:** [June 3, 2023, 3:23pm UTC](https://discuss.elastic.co/t/alerts-not-appearing-after-8-5-2-8-8-0-upgrade/335136 "2023-06-03T15:23:42Z")
I noticed that alerts are no longer appearing in the Security \> Alerts view after a 8.5.2 \> 8.8.0 upgrade. The noisy 'Component Object Model Hijacking' rule is no longer appearing during the usual browser upgrades, and … --- ## [Is one of Exceptions](https://discuss.elastic.co/t/is-one-of-exceptions/334992)
**Author:** [@emmanuel\_lankford](https://discuss.elastic.co/u/emmanuel_lankford)\ **Replies:** 1\ **Last updated:** [June 2, 2023, 4:18pm UTC](https://discuss.elastic.co/t/is-one-of-exceptions/334992 "2023-06-02T16:18:10Z")
Just a quick question, for 8.7 it is a little unclear in the documentation if "is one of" allows for wildcarding values or if matches is the only way. If matches is the only way, will there be a more efficient way to add… --- ## [Bulk Indexing of signals failed: object mapping for \[host\] tried to parse field \[host\] as object, but found a concrete value name](https://discuss.elastic.co/t/bulk-indexing-of-signals-failed-object-mapping-for-host-tried-to-parse-field-host-as-object-but-found-a-concrete-value-name/334705)
**Author:** [@UP\_NEWS](https://discuss.elastic.co/u/UP_NEWS)\ **Replies:** 1\ **Last updated:** [June 2, 2023, 3:53pm UTC](https://discuss.elastic.co/t/bulk-indexing-of-signals-failed-object-mapping-for-host-tried-to-parse-field-host-as-object-but-found-a-concrete-value-name/334705 "2023-06-02T15:53:18Z")
Hi team, the parser used for Kaspersky, more precisely in the host field, does not allow the triggering of the rule relating to the detection of malicious files once the conditions are met. --- ## [Elastic detection rules fail](https://discuss.elastic.co/t/elastic-detection-rules-fail/334547)
**Author:** [@xqaiviwjxzw](https://discuss.elastic.co/u/xqaiviwjxzw)\ **Replies:** 1\ **Last updated:** [June 2, 2023, 3:46pm UTC](https://discuss.elastic.co/t/elastic-detection-rules-fail/334547 "2023-06-02T15:46:43Z")
Rule failure at May 29, 2023 @ 12:09:44.438 Bulk Indexing of signals failed: ResponseError: search\_phase\_execution\_exception Caused by: illegal\_argument\_exception: Can't sort on field \[event.ingested\]; the field has… --- ## [MISP + Alerts](https://discuss.elastic.co/t/misp-alerts/334280)
**Author:** [@VellayLoket](https://discuss.elastic.co/u/VellayLoket)\ **Replies:** 7\ **Last updated:** [May 31, 2023, 6:37pm UTC](https://discuss.elastic.co/t/misp-alerts/334280 "2023-05-31T18:37:03Z")
I had connect MISP to ELK with filebeat. So now i have index named filebeat, there are many IOCs. Next i have index with network activity from workstations. So i want to match IP from winlog index with IOCs from MISP … --- ## [Endpoint Offline forced uninstall, can't uninstall completely](https://discuss.elastic.co/t/endpoint-offline-forced-uninstall-cant-uninstall-completely/334244)
**Author:** [@xqaiviwjxzw](https://discuss.elastic.co/u/xqaiviwjxzw)\ **Replies:** 9\ **Last updated:** [May 31, 2023, 9:49am UTC](https://discuss.elastic.co/t/endpoint-offline-forced-uninstall-cant-uninstall-completely/334244 "2023-05-31T09:49:32Z")
What is the solution to forcibly uninstalling the agent via fleet while offline, but the uninstallation is not clean and the logs are kept and the host cannot be contacted? Thanks --- ## [I have taken the Logs source of OpenCTI to make threatIntelligence but there is an error when displaying](https://discuss.elastic.co/t/i-have-taken-the-logs-source-of-opencti-to-make-threatintelligence-but-there-is-an-error-when-displaying/333746)
**Author:** [@Hoang\_Vu](https://discuss.elastic.co/u/Hoang_Vu)\ **Replies:** 0\ **Last updated:** [May 18, 2023, 8:55am UTC](https://discuss.elastic.co/t/i-have-taken-the-logs-source-of-opencti-to-make-threatintelligence-but-there-is-an-error-when-displaying/333746 "2023-05-18T08:55:05Z")
Before, I took MISP logs to do threatIntelligence but after I switch to Open CTI the same error shows again --- ## [How to check if Application run as administrator](https://discuss.elastic.co/t/how-to-check-if-application-run-as-administrator/333514)
**Author:** [@target\_test](https://discuss.elastic.co/u/target_test)\ **Replies:** 5\ **Last updated:** [May 26, 2023, 1:47am UTC](https://discuss.elastic.co/t/how-to-check-if-application-run-as-administrator/333514 "2023-05-26T01:47:14Z")
Hello i have a question Is there any rules to detect if any application run as administrator or if a user run the application as admin in windows machine ? --- ## [Assign current user to acknowledged alert / Elastic Security](https://discuss.elastic.co/t/assign-current-user-to-acknowledged-alert-elastic-security/334314)
**Author:** [@Mike\_S](https://discuss.elastic.co/u/Mike_S)\ **Replies:** 0\ **Last updated:** [May 25, 2023, 11:46am UTC](https://discuss.elastic.co/t/assign-current-user-to-acknowledged-alert-elastic-security/334314 "2023-05-25T11:46:16Z")
Hi, Is it possible to set the current user that has acknowledged an alert to a new field using the painless / runtime scripts to set a value? I've read over some documentation for it but can't figure out how to pull the… --- ## [Rule based on the @timestamp field](https://discuss.elastic.co/t/rule-based-on-the-timestamp-field/334230)
**Author:** [@hdia](https://discuss.elastic.co/u/hdia)\ **Replies:** 0\ **Last updated:** [May 24, 2023, 2:30pm UTC](https://discuss.elastic.co/t/rule-based-on-the-timestamp-field/334230 "2023-05-24T14:30:56Z")
Hello, I want to create a rule to detect any connection attempt between 7pm and 7am the next day. But unfortunately I am obliged to put the whole date (year, month, day, hour, minute and second) which obliges me to modi… --- ## [HELP, Interconnecting SentinelOne with Elasticsearch](https://discuss.elastic.co/t/help-interconnecting-sentinelone-with-elasticsearch/332774)
**Author:** [@Mdiouf01](https://discuss.elastic.co/u/Mdiouf01)\ **Replies:** 6\ **Last updated:** [May 23, 2023, 12:11pm UTC](https://discuss.elastic.co/t/help-interconnecting-sentinelone-with-elasticsearch/332774 "2023-05-23T12:11:34Z")
Hello, I need your help :face\_holding\_back\_tears::face\_holding\_back\_tears: I am a SOC analyst, and I want to interconnect SentinelOne with ELK SIEM. Could you help me to know if you have a tuto or clear documentation e… --- ## [Event.ingested huge time difference](https://discuss.elastic.co/t/event-ingested-huge-time-difference/333975)
**Author:** [@AnkurYogi](https://discuss.elastic.co/u/AnkurYogi)\ **Replies:** 6\ **Last updated:** [May 22, 2023, 11:06am UTC](https://discuss.elastic.co/t/event-ingested-huge-time-difference/333975 "2023-05-22T11:06:23Z")
Hello All, While investigating on an event I noticed there was a huge difference between event.created and event.ingested which created a confusion on the real event time. Later digging in docs resulted event.ingested… --- ## ["Elasticsearch connection failure" on newly installed Elastic Security server](https://discuss.elastic.co/t/elasticsearch-connection-failure-on-newly-installed-elastic-security-server/333707)
**Author:** [@Timothy\_Dilbert](https://discuss.elastic.co/u/Timothy_Dilbert)\ **Replies:** 1\ **Last updated:** [May 19, 2023, 10:50pm UTC](https://discuss.elastic.co/t/elasticsearch-connection-failure-on-newly-installed-elastic-security-server/333707 "2023-05-19T22:50:55Z")
I recently installed Elastic Security following the belowlinked YouTube video: Under Management \> Fleet it is showing "Fleet Server is not Healthy. A healthy Fleet server is required before you can enroll … --- ## [Policy settings/event collection - differentiate public vs private network access](https://discuss.elastic.co/t/policy-settings-event-collection-differentiate-public-vs-private-network-access/332661)
**Author:** [@yak990](https://discuss.elastic.co/u/yak990)\ **Replies:** 2\ **Last updated:** [May 18, 2023, 5:46pm UTC](https://discuss.elastic.co/t/policy-settings-event-collection-differentiate-public-vs-private-network-access/332661 "2023-05-18T17:46:45Z")
It would be great if we could limit network event tracking to just external access attempts instead of everything. Maybe have two checkboxes - internal network and external network, where internal network is defined as … --- ## [Elastic Defend Policy response failure](https://discuss.elastic.co/t/elastic-defend-policy-response-failure/332933)
**Author:** [@xqaiviwjxzw](https://discuss.elastic.co/u/xqaiviwjxzw)\ **Replies:** 3\ **Last updated:** [May 18, 2023, 5:00pm UTC](https://discuss.elastic.co/t/elastic-defend-policy-response-failure/332933 "2023-05-18T17:00:39Z")
Hello，The following error is displayed in fleet, what is the reason? How to solve it? Policy response failure The Endpoint did not apply the Policy correctly. Expand the Policy response above for more details. --- ## [Create a rule without a query](https://discuss.elastic.co/t/create-a-rule-without-a-query/333314)
**Author:** [@WhiteOwl](https://discuss.elastic.co/u/WhiteOwl)\ **Replies:** 1\ **Last updated:** [May 16, 2023, 10:14pm UTC](https://discuss.elastic.co/t/create-a-rule-without-a-query/333314 "2023-05-16T22:14:25Z")
Hello, is it possible to create a rule that does not have a query? For example, if I want a rule to fire off every 4-6hrs for analyst to perform a specific task, is that possible? --- ## [ThreatIntel Module - missing field \[otx.id\] when calculating fingerprint](https://discuss.elastic.co/t/threatintel-module-missing-field-otx-id-when-calculating-fingerprint/330928)
**Author:** [@jlopezsec](https://discuss.elastic.co/u/jlopezsec)\ **Replies:** 3\ **Last updated:** [May 16, 2023, 6:15pm UTC](https://discuss.elastic.co/t/threatintel-module-missing-field-otx-id-when-calculating-fingerprint/330928 "2023-05-16T18:15:37Z")
Dear Elastic community, I am encountering an error in the Threat Intel module of Elastic where I am receiving the following message: "missing field \[otx.id\] when calculating fingerprint." After researching the error, I … --- ## [Full disk access is not enabled, no error is displayed on the fleet side](https://discuss.elastic.co/t/full-disk-access-is-not-enabled-no-error-is-displayed-on-the-fleet-side/332793)
**Author:** [@xqaiviwjxzw](https://discuss.elastic.co/u/xqaiviwjxzw)\ **Replies:** 5\ **Last updated:** [May 15, 2023, 8:56pm UTC](https://discuss.elastic.co/t/full-disk-access-is-not-enabled-no-error-is-displayed-on-the-fleet-side/332793 "2023-05-15T20:56:41Z")
Full disk access was not enabled before, and an error will be displayed on the fleet side Now that full disk access is not enabled, no errors are displayed on the fleet side? --- ## [SentinelOne integration GeoIP database error](https://discuss.elastic.co/t/sentinelone-integration-geoip-database-error/333262)
**Author:** [@Anton\_H](https://discuss.elastic.co/u/Anton_H)\ **Replies:** 2\ **Last updated:** [May 13, 2023, 2:34pm UTC](https://discuss.elastic.co/t/sentinelone-integration-geoip-database-error/333262 "2023-05-13T14:34:44Z")
Hello, We use the SentinelOne integration through fleet in our Elastic Cloud environment. Events are being received and processed. The issue is we get "\_geoip\_database\_unavailable\_GeoLite2-City.mmdb" errors on all age… --- ## [Automation adding the password for basic security step #2 in Elasticsearch 7](https://discuss.elastic.co/t/automation-adding-the-password-for-basic-security-step-2-in-elasticsearch-7/333335)
**Author:** [@Chuck\_Reynolds](https://discuss.elastic.co/u/Chuck_Reynolds)\ **Replies:** 5\ **Last updated:** [May 12, 2023, 8:05pm UTC](https://discuss.elastic.co/t/automation-adding-the-password-for-basic-security-step-2-in-elasticsearch-7/333335 "2023-05-12T20:05:31Z")
How can I automate step 2 and pass a password to the following 2 commands? ./bin/elasticsearch-keystore add xpack.security.transport.ssl.keystore.secure\_password. ./bin/elasticsearch-keystore add xpack.security.transpo… --- ## [An error occurred during rule execution: message: "Parse Error: Header overflow"](https://discuss.elastic.co/t/an-error-occurred-during-rule-execution-message-parse-error-header-overflow/330017)
**Author:** [@kmz161](https://discuss.elastic.co/u/kmz161)\ **Replies:** 1\ **Last updated:** [May 12, 2023, 4:23pm UTC](https://discuss.elastic.co/t/an-error-occurred-during-rule-execution-message-parse-error-header-overflow/330017 "2023-05-12T16:23:03Z")
Hello! I have problem with Security Rules. This issue only affects the Threshold rules How can I fix issue? P.S. Elastic 7.17 --- ## [Elastic prebuilt rules not executed](https://discuss.elastic.co/t/elastic-prebuilt-rules-not-executed/330816)
**Author:** [@amatol1515](https://discuss.elastic.co/u/amatol1515)\ **Replies:** 1\ **Last updated:** [May 12, 2023, 4:03pm UTC](https://discuss.elastic.co/t/elastic-prebuilt-rules-not-executed/330816 "2023-05-12T16:03:55Z")
Hi Some of prebuilt rules not executed e.q. Execution result screen But when I duplicate this rules it works Execution results of Duplicated rule --- ## [Timeline template change timefilter to @timestamp instead of event.ingested?](https://discuss.elastic.co/t/timeline-template-change-timefilter-to-timestamp-instead-of-event-ingested/333087)
**Author:** [@elk\_jh](https://discuss.elastic.co/u/elk_jh)\ **Replies:** 2\ **Last updated:** [May 12, 2023, 8:54am UTC](https://discuss.elastic.co/t/timeline-template-change-timefilter-to-timestamp-instead-of-event-ingested/333087 "2023-05-12T08:54:44Z")
Hello~ I'm having an issue where I use a timeline template in the investigate in timeline feature of a rule in elastic security. When we create the rule, we override the timestamp to event.ingested. Our logs has a lag du… --- ## [Filter Windows Device Scanning from Direct Outbound SMB Connection rule](https://discuss.elastic.co/t/filter-windows-device-scanning-from-direct-outbound-smb-connection-rule/332248)
**Author:** [@Thyrum](https://discuss.elastic.co/u/Thyrum)\ **Replies:** 1\ **Last updated:** [May 11, 2023, 10:11pm UTC](https://discuss.elastic.co/t/filter-windows-device-scanning-from-direct-outbound-smb-connection-rule/332248 "2023-05-11T22:11:06Z")
Hi, We have been trying to filter out windows device scanning from our Direct Outbound SMB Connection rule logs. As is mentioned in the first note of Configure device discovery | Microsoft Learn, these SMB connections a… [Previous page](https://discuss.elastic.co/c/security/83.md?page=22) [Next page](https://discuss.elastic.co/c/security/83.md?page=24)