# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=24 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 25 --- ## [ elastic SIEM vs elastic Security](https://discuss.elastic.co/t/elastic-siem-vs-elastic-security/332846)
**Author:** [@THOR\_EL\_PODEROSO\_TEC](https://discuss.elastic.co/u/THOR_EL_PODEROSO_TEC)\ **Replies:** 1\ **Last updated:** [May 10, 2023, 8:40pm UTC](https://discuss.elastic.co/t/elastic-siem-vs-elastic-security/332846 "2023-05-10T20:40:08Z")
What is the difference between elastic SIEM and elastic Security? Is there a manual to install it in HyperV in onpremise? --- ## [OSQuery Integration user.id is \[long\] but ECS is \[keyword\]](https://discuss.elastic.co/t/osquery-integration-user-id-is-long-but-ecs-is-keyword/332700)
**Author:** [@oloughlinp](https://discuss.elastic.co/u/oloughlinp)\ **Replies:** 2\ **Last updated:** [May 10, 2023, 1:33pm UTC](https://discuss.elastic.co/t/osquery-integration-user-id-is-long-but-ecs-is-keyword/332700 "2023-05-10T13:33:50Z")
Hi all, I am trying to use some of the Windows prebuilt rules that rely on user.id in the eql query, but they are erroring out because my OSQuery manager indexes have user.id set to long, but the ECS standard (and what … --- ## [Endpoint Agent and Proxy Issues](https://discuss.elastic.co/t/endpoint-agent-and-proxy-issues/330977)
**Author:** [@jad3675](https://discuss.elastic.co/u/jad3675)\ **Replies:** 6\ **Last updated:** [May 4, 2023, 11:52am UTC](https://discuss.elastic.co/t/endpoint-agent-and-proxy-issues/330977 "2023-05-04T11:52:56Z")
Windows Server 2019 Elastic 8.6 Our environment has some devices that can only communicate with our Elastic cluster via a proxy. The elastic agent is setup with the environment registry keys (HKLM\\SYSTEM\\CurrentControl… --- ## [Defend API integration](https://discuss.elastic.co/t/defend-api-integration/329487)
**Author:** [@alextg](https://discuss.elastic.co/u/alextg)\ **Replies:** 4\ **Last updated:** [May 2, 2023, 6:03am UTC](https://discuss.elastic.co/t/defend-api-integration/329487 "2023-05-02T06:03:29Z")
Hi, I would like to create a customized Elastic Defend Integration via API, unfortunately such integration doesn't have the Preview API request as other integrations. I'm able to create the integration with the default… --- ## [Can't install Elastic Agent on MacOS Ventura (13.3.1) - Symlink](https://discuss.elastic.co/t/cant-install-elastic-agent-on-macos-ventura-13-3-1-symlink/330665)
**Author:** [@maof97](https://discuss.elastic.co/u/maof97)\ **Replies:** 6\ **Last updated:** [April 27, 2023, 9:44pm UTC](https://discuss.elastic.co/t/cant-install-elastic-agent-on-macos-ventura-13-3-1-symlink/330665 "2023-04-27T21:44:29Z")
Hey guys, I can't install elastic agent on my new MacBook running MacOS Ventura 13.3.1. Installing I get the following message: martin@Martins-MacBook-Pro-14 elastic-agent-8.7.0-darwin-aarch64 % sudo ./elastic-agent in… --- ## [Network scan](https://discuss.elastic.co/t/network-scan/330717)
**Author:** [@TheMadmax](https://discuss.elastic.co/u/TheMadmax)\ **Replies:** 2\ **Last updated:** [April 27, 2023, 12:39pm UTC](https://discuss.elastic.co/t/network-scan/330717 "2023-04-27T12:39:30Z")
Hello, I try to create a rule to detect a network scan. For example, generate an alert if more than 10 unique destinations have been accessed from the same source IP within 1 minute. but I don't see how to indicate … --- ## [Extracting Detection Rule](https://discuss.elastic.co/t/extracting-detection-rule/330549)
**Author:** [@Aliz6](https://discuss.elastic.co/u/Aliz6)\ **Replies:** 1\ **Last updated:** [April 27, 2023, 10:49am UTC](https://discuss.elastic.co/t/extracting-detection-rule/330549 "2023-04-27T10:49:20Z")
Hi there, I was wondering if there is a way to extract all of the detection use cases (built-in and custom) in an excel sheet rather a json format file. Any suggestions would be helpful. Thanks. --- ## [Domain gets resolved to IP before cert verification](https://discuss.elastic.co/t/domain-gets-resolved-to-ip-before-cert-verification/330935)
**Author:** [@Octelly](https://discuss.elastic.co/u/Octelly)\ **Replies:** 0\ **Last updated:** [April 27, 2023, 9:52am UTC](https://discuss.elastic.co/t/domain-gets-resolved-to-ip-before-cert-verification/330935 "2023-04-27T09:52:31Z")
I have a Step-CA instance from which I obtain certificates through lego's CLI. The CA is trusted on all nodes system-wide and the certificates are generated for their domains. Elasticsearch is configured to use these dom… --- ## [ELastic Defend agent high latency on DCs](https://discuss.elastic.co/t/elastic-defend-agent-high-latency-on-dcs/328766)
**Author:** [@Kelly\_Slavens](https://discuss.elastic.co/u/Kelly_Slavens)\ **Replies:** 2\ **Last updated:** [April 24, 2023, 4:44pm UTC](https://discuss.elastic.co/t/elastic-defend-agent-high-latency-on-dcs/328766 "2023-04-24T16:44:41Z")
We're seeing extreme latency on 2022 Domain controllers when Elastic Defend 8.6.2 Malicious Behavior rules are enabled. The server becomes very sluggish but performance metrics don't appear to show any sign of excesses l… --- ## [Is it Possible to have a Hierarchy of Rules](https://discuss.elastic.co/t/is-it-possible-to-have-a-hierarchy-of-rules/329210)
**Author:** [@juliette.littlewood](https://discuss.elastic.co/u/juliette.littlewood)\ **Replies:** 2\ **Last updated:** [April 24, 2023, 1:51pm UTC](https://discuss.elastic.co/t/is-it-possible-to-have-a-hierarchy-of-rules/329210 "2023-04-24T13:51:00Z")
Hi everyone, I'm setting up custom query rules that alert when fields in a document exceed pre-defined thresholds. In some circumstances, if the document category is a particular string value, then the thresholds shoul… --- ## [Question about DNS in a "regular" network](https://discuss.elastic.co/t/question-about-dns-in-a-regular-network/330596)
**Author:** [@GKre](https://discuss.elastic.co/u/GKre)\ **Replies:** 0\ **Last updated:** [April 24, 2023, 4:49am UTC](https://discuss.elastic.co/t/question-about-dns-in-a-regular-network/330596 "2023-04-24T04:49:58Z")
Hello, after collecting a lot of data from my firewall i wonder about the "structure" of the data in my network. What i found out in the past - there's more than 50 % of the overall traffic caused by DNS. My sonicwall… --- ## [Remove setup directory agent old version](https://discuss.elastic.co/t/remove-setup-directory-agent-old-version/330244)
**Author:** [@GKre](https://discuss.elastic.co/u/GKre)\ **Replies:** 2\ **Last updated:** [April 19, 2023, 7:35am UTC](https://discuss.elastic.co/t/remove-setup-directory-agent-old-version/330244 "2023-04-19T07:35:05Z")
Hello, due to the wonderfull help inside this forum i come more and more into the system and i really like what i learn and see. I had the problem that upgrade of the agent to 8.7.0 did not work like expected. So i ch… --- ## [How to test Elasticsearch rules?](https://discuss.elastic.co/t/how-to-test-elasticsearch-rules/329448)
**Author:** [@iojas](https://discuss.elastic.co/u/iojas)\ **Replies:** 1\ **Last updated:** [April 17, 2023, 7:23pm UTC](https://discuss.elastic.co/t/how-to-test-elasticsearch-rules/329448 "2023-04-17T19:23:34Z")
I have successfully installed the elastic-agent on Kubernetes cluster and see them showing up in the fleet. I turned on bunch of rules, I see them as enabled. now I want to be able to trigger one of those rules. somethi… --- ## [Packetbeat Alerts](https://discuss.elastic.co/t/packetbeat-alerts/329841)
**Author:** [@Joel\_Goncalves](https://discuss.elastic.co/u/Joel_Goncalves)\ **Replies:** 1\ **Last updated:** [April 14, 2023, 4:27pm UTC](https://discuss.elastic.co/t/packetbeat-alerts/329841 "2023-04-14T16:27:46Z")
I have elasticsearch, kibana and packetbeat running and I want to get alerts whenever there is abnormal activity with packetbeat information. How do I do it? My elasticsearch, kibana and packetbeat are running on-premesi… --- ## [Limit storage needs by automatically remove data after 28 days](https://discuss.elastic.co/t/limit-storage-needs-by-automatically-remove-data-after-28-days/329865)
**Author:** [@GKre](https://discuss.elastic.co/u/GKre)\ **Replies:** 3\ **Last updated:** [April 13, 2023, 5:39am UTC](https://discuss.elastic.co/t/limit-storage-needs-by-automatically-remove-data-after-28-days/329865 "2023-04-13T05:39:23Z")
I have my small test environment up and running. It is collecting data from different sources. Now i wonder how i can handle the effective file storage. Only 1 node in the cluster - non productive. Is it possible to co… --- ## [Bulk alerting configuration](https://discuss.elastic.co/t/bulk-alerting-configuration/327511)
**Author:** [@rossw](https://discuss.elastic.co/u/rossw)\ **Replies:** 5\ **Last updated:** [April 11, 2023, 9:13pm UTC](https://discuss.elastic.co/t/bulk-alerting-configuration/327511 "2023-04-11T21:13:48Z")
Afternoon, We are using the alerting functionality inside the Elastic Security toolset, and we have turned on about 100-odd rules. We have created email and webhook integrations and have started to tune the data being … --- ## [How to exploit rules](https://discuss.elastic.co/t/how-to-exploit-rules/328174)
**Author:** [@Iroshu](https://discuss.elastic.co/u/Iroshu)\ **Replies:** 10\ **Last updated:** [April 11, 2023, 8:58am UTC](https://discuss.elastic.co/t/how-to-exploit-rules/328174 "2023-04-11T08:58:30Z")
Dear team, We are actually playing with the detection of elastic and something seems weird for us. We have created a Rule and we add an action in order to populate an index using our collector : We choose all fied… --- ## [Integration sophos Firewall with elastic](https://discuss.elastic.co/t/integration-sophos-firewall-with-elastic/329454)
**Author:** [@Ahmad\_Shrateh](https://discuss.elastic.co/u/Ahmad_Shrateh)\ **Replies:** 10\ **Last updated:** [April 9, 2023, 1:17pm UTC](https://discuss.elastic.co/t/integration-sophos-firewall-with-elastic/329454 "2023-04-09T13:17:26Z")
Dear there. Im trying to connect sophos firewall with elastic but i don't receive any logs. Im deployed an agent with sophos integration, and i followed the instructions on the elastic, i add my firewall ip instead … --- ## [What to get URL / web access log info?](https://discuss.elastic.co/t/what-to-get-url-web-access-log-info/329111)
**Author:** [@GKre](https://discuss.elastic.co/u/GKre)\ **Replies:** 1\ **Last updated:** [April 4, 2023, 8:39pm UTC](https://discuss.elastic.co/t/what-to-get-url-web-access-log-info/329111 "2023-04-04T20:39:16Z")
Hello, i am using "Elastic Defend" and "System" integrations at the moment but i wonder how i can monitor outgoing web requests wih this? Do i need a different integration to see all browers and web access by apllicati… --- ## [Detection Rule CLI still relevant?](https://discuss.elastic.co/t/detection-rule-cli-still-relevant/328987)
**Author:** [@JCoffey85](https://discuss.elastic.co/u/JCoffey85)\ **Replies:** 1\ **Last updated:** [April 4, 2023, 4:07pm UTC](https://discuss.elastic.co/t/detection-rule-cli-still-relevant/328987 "2023-04-04T16:07:07Z")
Hello All, Long time lurker and new user to Elastic Stack. Is the Detection-Rule CLI still applicable in the 'latest n greatest' installation of elastic 8.6? (GitHub - elastic/detection-rules: Rules for Elastic Securit… --- ## [Snowflake -Pyspark numPartitions support](https://discuss.elastic.co/t/snowflake-pyspark-numpartitions-support/329203)
**Author:** [@digitalspecz](https://discuss.elastic.co/u/digitalspecz)\ **Replies:** 2\ **Last updated:** [April 4, 2023, 1:30am UTC](https://discuss.elastic.co/t/snowflake-pyspark-numpartitions-support/329203 "2023-04-04T01:30:14Z")
We're attempting to run the snowflake query with Pyspark, and we've set numPartitions to 10 and submitted a spark query. However, when I checked the Snowflake History tab. As far as I can tell, only one query is being ex… --- ## [Multiple index search](https://discuss.elastic.co/t/multiple-index-search/329180)
**Author:** [@Phoenix1](https://discuss.elastic.co/u/Phoenix1)\ **Replies:** 5\ **Last updated:** [April 3, 2023, 3:43pm UTC](https://discuss.elastic.co/t/multiple-index-search/329180 "2023-04-03T15:43:28Z")
How to search logs in multiple index, within discover it does not gives option to select multiple indexes in drop down option. --- ## [Timeline displaying no data views](https://discuss.elastic.co/t/timeline-displaying-no-data-views/328841)
**Author:** [@AndyBox2](https://discuss.elastic.co/u/AndyBox2)\ **Replies:** 1\ **Last updated:** [April 3, 2023, 2:31pm UTC](https://discuss.elastic.co/t/timeline-displaying-no-data-views/328841 "2023-04-03T14:31:48Z")
I am all very new to the ELK stack. I am attempting to implement a risk based score into my test environment. I have successfully set up alerts into the SIEM. However, when I go into the timeline, the displayed data vie… --- ## [Elastic Defend - impact on application](https://discuss.elastic.co/t/elastic-defend-impact-on-application/328880)
**Author:** [@GKre](https://discuss.elastic.co/u/GKre)\ **Replies:** 1\ **Last updated:** [April 1, 2023, 4:48am UTC](https://discuss.elastic.co/t/elastic-defend-impact-on-application/328880 "2023-04-01T04:48:50Z")
Hello, i deployed Elastic Defend Integration on my endpoints and also on my two DC's. One of the DC's is hosting go1984 - a video surveilance application i use since many years. Soon after the Integration had been dep… --- ## [Sharing Case ID value using Elastic Case Management webhook](https://discuss.elastic.co/t/sharing-case-id-value-using-elastic-case-management-webhook/328641)
**Author:** [@yzaritskyi](https://discuss.elastic.co/u/yzaritskyi)\ **Replies:** 2\ **Last updated:** [March 30, 2023, 2:05pm UTC](https://discuss.elastic.co/t/sharing-case-id-value-using-elastic-case-management-webhook/328641 "2023-03-30T14:05:45Z")
Greetings! I'm on the way to implementing the automation solution for our Elastic Security Cases. While working on some automation scripts, I got a problem with the response to Cases. For example, when the Case is crea… --- ## [Rule Preview not Working](https://discuss.elastic.co/t/rule-preview-not-working/327737)
**Author:** [@j91321](https://discuss.elastic.co/u/j91321)\ **Replies:** 3\ **Last updated:** [March 24, 2023, 9:55am UTC](https://discuss.elastic.co/t/rule-preview-not-working/327737 "2023-03-24T09:55:36Z")
I have this weird problem where detection engine rules preview is not working for users. Now the users have roles that grant them read access to .preview.alerts-security.alerts-\ and All Kibana pirvileges on Ki… --- ## [Byte size in is bigger than real traffic packages in Network Explore](https://discuss.elastic.co/t/byte-size-in-is-bigger-than-real-traffic-packages-in-network-explore/328145)
**Author:** [@wishes9](https://discuss.elastic.co/u/wishes9)\ **Replies:** 2\ **Last updated:** [March 24, 2023, 3:38am UTC](https://discuss.elastic.co/t/byte-size-in-is-bigger-than-real-traffic-packages-in-network-explore/328145 "2023-03-24T03:38:22Z")
elasticsearch-8.6.1 kibana-8.6.1 logstash-8.6.1 I install packetbeat in the VM which install elastic stack. When I try to use Security - Explore - Network in Kibana, I find that the traffice Bytes account is much more… --- ## [RAR file download from the internet](https://discuss.elastic.co/t/rar-file-download-from-the-internet/327072)
**Author:** [@Maretti](https://discuss.elastic.co/u/Maretti)\ **Replies:** 3\ **Last updated:** [March 23, 2023, 3:17pm UTC](https://discuss.elastic.co/t/rar-file-download-from-the-internet/327072 "2023-03-23T15:17:31Z")
I tried this rule since a lot of malware is spread using password protected RAR files Roshal Archive (RAR) or PowerShell File Downloaded from the Internet | Elastic Security Solution \[7.17\] | Elastic The Query the rule… --- ## [Feature Request for more robust vector graphics (Vega not enough) so I can generate good looking network maps (non-geographic)](https://discuss.elastic.co/t/feature-request-for-more-robust-vector-graphics-vega-not-enough-so-i-can-generate-good-looking-network-maps-non-geographic/328286)
**Author:** [@J\_Todd](https://discuss.elastic.co/u/J_Todd)\ **Replies:** 2\ **Last updated:** [March 23, 2023, 2:15pm UTC](https://discuss.elastic.co/t/feature-request-for-more-robust-vector-graphics-vega-not-enough-so-i-can-generate-good-looking-network-maps-non-geographic/328286 "2023-03-23T14:15:15Z")
I want to be able to generate, within Kibana and / or Elastic Security, non-geographic, good looking network maps like these: Currently there doesn't seem to be any way to do this in any Elastic product no matter… --- ## [Threat intelligence](https://discuss.elastic.co/t/threat-intelligence/328211)
**Author:** [@ermilan2309](https://discuss.elastic.co/u/ermilan2309)\ **Replies:** 7\ **Last updated:** [March 22, 2023, 9:30pm UTC](https://discuss.elastic.co/t/threat-intelligence/328211 "2023-03-22T21:30:33Z")
Hello, I would like to integrate threat intelligence with wazuh. How can I do that. what are the ways to archive this ? I have deployed the hive , cortex and MISP for threat intelligence but do not know how to integra… [Previous page](https://discuss.elastic.co/c/security/83.md?page=23) [Next page](https://discuss.elastic.co/c/security/83.md?page=25)