# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=25 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 26 --- ## [Creating Multiple Alert Documents when Alert is Triggered](https://discuss.elastic.co/t/creating-multiple-alert-documents-when-alert-is-triggered/327088)
**Author:** [@juliette.littlewood](https://discuss.elastic.co/u/juliette.littlewood)\ **Replies:** 3\ **Last updated:** [March 10, 2023, 11:46pm UTC](https://discuss.elastic.co/t/creating-multiple-alert-documents-when-alert-is-triggered/327088 "2023-03-10T23:46:47Z")
Hi all, I've got a bit of a unique issue. For the system I am developing, data records will be ingested and compared against thresholds to confirm if values are anomalous. To test out this functionality I've set up an … --- ## [Spike in failed logon events ML rule alerting](https://discuss.elastic.co/t/spike-in-failed-logon-events-ml-rule-alerting/327642)
**Author:** [@Maretti](https://discuss.elastic.co/u/Maretti)\ **Replies:** 0\ **Last updated:** [March 14, 2023, 9:31am UTC](https://discuss.elastic.co/t/spike-in-failed-logon-events-ml-rule-alerting/327642 "2023-03-14T09:31:53Z")
Hi everyone I am experimenting with the ML learning rule that alerts when a spike happens in failed logon events. I did a RDP bruteforce from kali to windows in the bruteforce the password did get guessed so the host is… --- ## [Event Filter \* field](https://discuss.elastic.co/t/event-filter-field/325674)
**Author:** [@NathanLau](https://discuss.elastic.co/u/NathanLau)\ **Replies:** 4\ **Last updated:** [March 14, 2023, 1:12am UTC](https://discuss.elastic.co/t/event-filter-field/325674 "2023-03-14T01:12:04Z")
Hi all , The purpose is refuse receive some logs. (Endpoint) there are a lot of event on everyday , don't want to receive not meaningful logs to occupied the space , how could filter all value of \* or filter the field… --- ## [Elastic Agent USB Locking Feature](https://discuss.elastic.co/t/elastic-agent-usb-locking-feature/327323)
**Author:** [@ali.sharjeel](https://discuss.elastic.co/u/ali.sharjeel)\ **Replies:** 3\ **Last updated:** [March 10, 2023, 11:43pm UTC](https://discuss.elastic.co/t/elastic-agent-usb-locking-feature/327323 "2023-03-10T23:43:53Z")
Is there any feature like we have in antivirus to lock usb devices from plugging in Elastic Agent? --- ## [Elastic Security Rules Analytics](https://discuss.elastic.co/t/elastic-security-rules-analytics/326890)
**Author:** [@Alexander\_A](https://discuss.elastic.co/u/Alexander_A)\ **Replies:** 2\ **Last updated:** [March 10, 2023, 9:38pm UTC](https://discuss.elastic.co/t/elastic-security-rules-analytics/326890 "2023-03-10T21:38:13Z")
Is there a way to get how much time it gets to execute all security rules. In "Stack Management" -\> "Rules and Connectors" analytics available per each rule but summary analytics seems to be missing. For example all rule… --- ## [Issue enrolling elastic agent in docker](https://discuss.elastic.co/t/issue-enrolling-elastic-agent-in-docker/325511)
**Author:** [@Anon](https://discuss.elastic.co/u/Anon)\ **Replies:** 1\ **Last updated:** [March 10, 2023, 8:05pm UTC](https://discuss.elastic.co/t/issue-enrolling-elastic-agent-in-docker/325511 "2023-03-10T20:05:23Z")
I have "successfully" enrolled elastic agent. Kibana shows that the agent is Healthy for some time, until Endpoint Security starts communication with Elasticsearch. In logs I get following error. {"@timestamp":"2023-0… --- ## [ELK Vulnerability Detection](https://discuss.elastic.co/t/elk-vulnerability-detection/327261)
**Author:** [@cyberintellect](https://discuss.elastic.co/u/cyberintellect)\ **Replies:** 2\ **Last updated:** [March 10, 2023, 6:01am UTC](https://discuss.elastic.co/t/elk-vulnerability-detection/327261 "2023-03-10T06:01:03Z")
Hi guys, I was wondering if the function exists or is being looked at to implement vulnerability detections via the agent like with Wazuh Vulnerability Detection module. I searched the forum but I'm not seeing, might b… --- ## [Creating Endpoint Exception for one endpoint](https://discuss.elastic.co/t/creating-endpoint-exception-for-one-endpoint/326593)
**Author:** [@slash24](https://discuss.elastic.co/u/slash24)\ **Replies:** 1\ **Last updated:** [March 9, 2023, 11:41pm UTC](https://discuss.elastic.co/t/creating-endpoint-exception-for-one-endpoint/326593 "2023-03-09T23:41:43Z")
How do I create an Endpoint Exception that only apply to one specfic host? I have alot of servers in one Fleet policy and would like to excluse w3wp.exe. This however a dangerous blindspot so of course i want to limit th… --- ## [Importing rules with detection\_rules CLI](https://discuss.elastic.co/t/importing-rules-with-detection-rules-cli/327190)
**Author:** [@Fredrick](https://discuss.elastic.co/u/Fredrick)\ **Replies:** 1\ **Last updated:** [March 9, 2023, 10:35pm UTC](https://discuss.elastic.co/t/importing-rules-with-detection-rules-cli/327190 "2023-03-09T22:35:55Z")
Hello! I've been recently importing rules with detection\_rules - detection-rules/CLI.md at main · elastic/detection-rules · GitHub. My usecase is to convert our custom Kibana rules into toml files so we can manage our c… --- ## [Endpoint service not honoring proxy environment variables](https://discuss.elastic.co/t/endpoint-service-not-honoring-proxy-environment-variables/327234)
**Author:** [@indyg](https://discuss.elastic.co/u/indyg)\ **Replies:** 2\ **Last updated:** [March 9, 2023, 10:26pm UTC](https://discuss.elastic.co/t/endpoint-service-not-honoring-proxy-environment-variables/327234 "2023-03-09T22:26:13Z")
We're testing out deploying Defend to our fleet but are running into an issue where the endpoint service isn't honoring the HTTP\_PROXY or HTTPS\_PROXY environment variables, which for us is needed to push documents into E… --- ## [Custom Query detection Rule is not runnig on my elk](https://discuss.elastic.co/t/custom-query-detection-rule-is-not-runnig-on-my-elk/327256)
**Author:** [@Sajith](https://discuss.elastic.co/u/Sajith)\ **Replies:** 2\ **Last updated:** [March 9, 2023, 10:20pm UTC](https://discuss.elastic.co/t/custom-query-detection-rule-is-not-runnig-on-my-elk/327256 "2023-03-09T22:20:54Z")
I created a custom detection rule which is just a query for failed logins (event.code : "4625") I have pointed it to the index pattern and I can see the output on preview results as well. After enabling the rule there … --- ## [Change the stream names](https://discuss.elastic.co/t/change-the-stream-names/327153)
**Author:** [@bex](https://discuss.elastic.co/u/bex)\ **Replies:** 3\ **Last updated:** [March 7, 2023, 9:15am UTC](https://discuss.elastic.co/t/change-the-stream-names/327153 "2023-03-07T09:15:30Z")
Is it possible to change or indicate the stream(index) name like "index =\> "client-1-%{+dd.MM.YYYY}" when using fleet server and elastic agent in logstash output. There are streams with default name like "logs-auditd.lo… --- ## [Problem with PowerShell security rules that use process.args](https://discuss.elastic.co/t/problem-with-powershell-security-rules-that-use-process-args/326861)
**Author:** [@Maretti](https://discuss.elastic.co/u/Maretti)\ **Replies:** 2\ **Last updated:** [March 6, 2023, 9:58am UTC](https://discuss.elastic.co/t/problem-with-powershell-security-rules-that-use-process-args/326861 "2023-03-06T09:58:32Z")
The Problem Rules that are based off powershell like Disabling Windows Defender Security Settings via PowerShell and Windows Firewall Disabled via PowerShell are not giving alerts back. Windows Firewall Disabled via Pow… --- ## [Integration](https://discuss.elastic.co/t/integration/326744)
**Author:** [@bex](https://discuss.elastic.co/u/bex)\ **Replies:** 7\ **Last updated:** [March 3, 2023, 6:46am UTC](https://discuss.elastic.co/t/integration/326744 "2023-03-03T06:46:36Z")
I would like to clarify, what is the difference between "EndPoint Security" and "Elastic Defend" integrations? But there is only "Elastic Defend" in "integration" tab. But in "rules", it is asked to add "Endpoint securi… --- ## [How to develop the Security Dashboard](https://discuss.elastic.co/t/how-to-develop-the-security-dashboard/326483)
**Author:** [@red-dragon](https://discuss.elastic.co/u/red-dragon)\ **Replies:** 1\ **Last updated:** [February 27, 2023, 4:14pm UTC](https://discuss.elastic.co/t/how-to-develop-the-security-dashboard/326483 "2023-02-27T16:14:19Z")
I wanted to review the security panel codes and develop them But I don't know in which part the codes of the security part are located --- ## [Agent for Endpoint is shown as unhealthy](https://discuss.elastic.co/t/agent-for-endpoint-is-shown-as-unhealthy/326485)
**Author:** [@Cosmic\_Season](https://discuss.elastic.co/u/Cosmic_Season)\ **Replies:** 1\ **Last updated:** [February 27, 2023, 3:41pm UTC](https://discuss.elastic.co/t/agent-for-endpoint-is-shown-as-unhealthy/326485 "2023-02-27T15:41:15Z")
I am unable to understand the issue. I tried to uninstall and install multiple times but the agent still shows as "Unhealthy". The agent is installed on windows and I am unable to open the file from GUI as it says "acce… --- ## [Elastic Agent Google Workspace module retrieves repeated events](https://discuss.elastic.co/t/elastic-agent-google-workspace-module-retrieves-repeated-events/323516)
**Author:** [@German\_Bravo](https://discuss.elastic.co/u/German_Bravo)\ **Replies:** 8\ **Last updated:** [February 27, 2023, 2:46pm UTC](https://discuss.elastic.co/t/elastic-agent-google-workspace-module-retrieves-repeated-events/323516 "2023-02-27T14:46:12Z")
Hi im using Elastic Agent version 8.6 installed on one host, applying a policy with Google Workspace module enabled retrieving all type of events from our Google Workspace tenant. It works perfectly as alert rules give … --- ## [Elastic security time zone issue](https://discuss.elastic.co/t/elastic-security-time-zone-issue/325915)
**Author:** [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\ **Replies:** 4\ **Last updated:** [February 27, 2023, 12:43pm UTC](https://discuss.elastic.co/t/elastic-security-time-zone-issue/325915 "2023-02-27T12:43:34Z")
Hello Community, I have an issue with the TIMEZONE in the SECURITY – ALERTS section, the logs are received in UTC+1 in Discovery and in UTC+3 in SECURITY – ALERTS. Knowning that the timezone configured at the kibana i… --- ## [Huge size for elastic endpoint (defend) integration indices?](https://discuss.elastic.co/t/huge-size-for-elastic-endpoint-defend-integration-indices/326344)
**Author:** [@rebug](https://discuss.elastic.co/u/rebug)\ **Replies:** 4\ **Last updated:** [February 27, 2023, 9:36am UTC](https://discuss.elastic.co/t/huge-size-for-elastic-endpoint-defend-integration-indices/326344 "2023-02-27T09:36:46Z")
Hello, Cluster information: 3 nodes with 1TB I have configured a fleet server with elastic defend integration to start using elastic security. Currently only 2 servers are enrolled with the agent. Here is the integra… --- ## [Endpoint events dont contain process or file hash](https://discuss.elastic.co/t/endpoint-events-dont-contain-process-or-file-hash/324583)
**Author:** [@yak990](https://discuss.elastic.co/u/yak990)\ **Replies:** 2\ **Last updated:** [February 25, 2023, 1:51am UTC](https://discuss.elastic.co/t/endpoint-events-dont-contain-process-or-file-hash/324583 "2023-02-25T01:51:28Z")
I'm looking through a series of endpoint events, and do not see the hash of the process or file. The events are in endpoint.events.registry in this case. The hash is important, because its easy to cut and paste that in… --- ## [Alert rules requiring endpoint integration 8.2.0 when 8.6.1 is installed already](https://discuss.elastic.co/t/alert-rules-requiring-endpoint-integration-8-2-0-when-8-6-1-is-installed-already/326219)
**Author:** [@Kelly\_Slavens](https://discuss.elastic.co/u/Kelly_Slavens)\ **Replies:** 2\ **Last updated:** [February 24, 2023, 3:31pm UTC](https://discuss.elastic.co/t/alert-rules-requiring-endpoint-integration-8-2-0-when-8-6-1-is-installed-already/326219 "2023-02-24T15:31:10Z")
We're seeing an issue in the Rules section. Several rules indicate they require the Endpoint Integration to be installed. Endpoint is installed and deployed on thousands of devices. The link provided points to version 8… --- ## [New "Elastic Defend" integration not recognized by rules (8.6.2)](https://discuss.elastic.co/t/new-elastic-defend-integration-not-recognized-by-rules-8-6-2/326436)
**Author:** [@syk](https://discuss.elastic.co/u/syk)\ **Replies:** 2\ **Last updated:** [February 24, 2023, 3:06pm UTC](https://discuss.elastic.co/t/new-elastic-defend-integration-not-recognized-by-rules-8-6-2/326436 "2023-02-24T15:06:57Z")
Hi, I'm not able to satisfy the dependency of the "Prebuilt Security Detection Rules" on a fresh installation (on premises) of Elastic and Kibana version 8.6.2: Rules demand "Endpoint Security" integration being instal… --- ## [Create a rule that alerts on out of hours](https://discuss.elastic.co/t/create-a-rule-that-alerts-on-out-of-hours/326351)
**Author:** [@Alex.W](https://discuss.elastic.co/u/Alex.W)\ **Replies:** 3\ **Last updated:** [February 24, 2023, 2:50pm UTC](https://discuss.elastic.co/t/create-a-rule-that-alerts-on-out-of-hours/326351 "2023-02-24T14:50:11Z")
Hello, I have just started using Elastic and am trying to create a rule that will alert for role assignment changes in AzureAD out of office hours. Using @timestamp appears to be the option but I cant seem to have it l… --- ## [Installed Lateral movement detection package but couldn't find the package under ML preconfigured jobs](https://discuss.elastic.co/t/installed-lateral-movement-detection-package-but-couldnt-find-the-package-under-ml-preconfigured-jobs/325809)
**Author:** [@deepthi.manam](https://discuss.elastic.co/u/deepthi.manam)\ **Replies:** 2\ **Last updated:** [February 20, 2023, 1:31am UTC](https://discuss.elastic.co/t/installed-lateral-movement-detection-package-but-couldnt-find-the-package-under-ml-preconfigured-jobs/325809 "2023-02-20T01:31:40Z")
I have installed lateral movement detection package under Integrations but haven't created any policies. I couldn't find Lateral movement detection under ML preconfigured jobs while creating a job. Does this require a i… --- ## [UNABLE to filter the fields in the security alerts window](https://discuss.elastic.co/t/unable-to-filter-the-fields-in-the-security-alerts-window/324242)
**Author:** [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\ **Replies:** 9\ **Last updated:** [February 18, 2023, 11:11pm UTC](https://discuss.elastic.co/t/unable-to-filter-the-fields-in-the-security-alerts-window/324242 "2023-02-18T23:11:07Z")
Hello every body, Many alerts are generated in the security Alerts window of elastic 8.3.1, Especially attempts of brute force: The winlog. event\_data. The TargetUserName field is the user-specific field. I'm no… --- ## [Elastic Defend host is not registered to the endpoint](https://discuss.elastic.co/t/elastic-defend-host-is-not-registered-to-the-endpoint/325805)
**Author:** [@xqaiviwjxzw](https://discuss.elastic.co/u/xqaiviwjxzw)\ **Replies:** 1\ **Last updated:** [February 17, 2023, 2:35pm UTC](https://discuss.elastic.co/t/elastic-defend-host-is-not-registered-to-the-endpoint/325805 "2023-02-17T14:35:50Z")
Hello everyone, I have this problem and I am looking for your help. I created a new policy in Fleet that includes Elastic Defend integration, but my newly registered elastic agent is not registered to the host of the en… --- ## [How do you handle lists in rules](https://discuss.elastic.co/t/how-do-you-handle-lists-in-rules/325558)
**Author:** [@m-logs](https://discuss.elastic.co/u/m-logs)\ **Replies:** 1\ **Last updated:** [February 16, 2023, 9:11am UTC](https://discuss.elastic.co/t/how-do-you-handle-lists-in-rules/325558 "2023-02-16T09:11:58Z")
Hello everyone, Imagine the following szenario: You have a bigger infrastructure and you have different systems in that environment. Let's say you have different rule approaches to several subsets of systems (identified… --- ## [Security Alert ：How to suppress repeat alarms](https://discuss.elastic.co/t/security-alert-how-to-suppress-repeat-alarms/325565)
**Author:** [@xqaiviwjxzw](https://discuss.elastic.co/u/xqaiviwjxzw)\ **Replies:** 1\ **Last updated:** [February 15, 2023, 10:29am UTC](https://discuss.elastic.co/t/security-alert-how-to-suppress-repeat-alarms/325565 "2023-02-15T10:29:32Z")
More than 100 duplicate alarms are generated in 1 minute, what can be done to suppress duplicate alarms and display only one of the duplicate alarms? --- ## [Elastic Security Manage - EndPoint not work](https://discuss.elastic.co/t/elastic-security-manage-endpoint-not-work/325367)
**Author:** [@NathanLau](https://discuss.elastic.co/u/NathanLau)\ **Replies:** 8\ **Last updated:** [February 15, 2023, 2:51am UTC](https://discuss.elastic.co/t/elastic-security-manage-endpoint-not-work/325367 "2023-02-15T02:51:03Z")
Hi , When I deleted agents for endpoint , I want to re-add agent to endpoint but not work , even I reinstall fleet server or any hosts to security --\> manage --\> Endpoint. references: Keep showing this to inst… --- ## [Detection rule execution failure: "Rule registry writing is disabled due to an error during Rule Data Client initialization."](https://discuss.elastic.co/t/detection-rule-execution-failure-rule-registry-writing-is-disabled-due-to-an-error-during-rule-data-client-initialization/325356)
**Author:** [@bil15](https://discuss.elastic.co/u/bil15)\ **Replies:** 3\ **Last updated:** [February 14, 2023, 6:46pm UTC](https://discuss.elastic.co/t/detection-rule-execution-failure-rule-registry-writing-is-disabled-due-to-an-error-during-rule-data-client-initialization/325356 "2023-02-14T18:46:17Z")
Hello! I am struggling with error that leads to detection rules execution failure. For the context: I am creating new detection rules in separate Space with limited permissions, so I am not an admin. When a detection … [Previous page](https://discuss.elastic.co/c/security/83.md?page=24) [Next page](https://discuss.elastic.co/c/security/83.md?page=26)