# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=26 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 27 --- ## [Use of Indicator Match Rules using Cross Cluster Search](https://discuss.elastic.co/t/use-of-indicator-match-rules-using-cross-cluster-search/323163)
**Author:** [@jcruz](https://discuss.elastic.co/u/jcruz)\ **Replies:** 7\ **Last updated:** [February 7, 2023, 8:44pm UTC](https://discuss.elastic.co/t/use-of-indicator-match-rules-using-cross-cluster-search/323163 "2023-02-07T20:44:02Z")
Hello! We have set up an infrastrucure of SIEM using Elastic Security and we are using multiple elasticsearch clusters distributed in different locations (multiples datacenters) and we have configured CCS (Cross Cluster… --- ## [Processing a TAXII feed?](https://discuss.elastic.co/t/processing-a-taxii-feed/324678)
**Author:** [@yak990](https://discuss.elastic.co/u/yak990)\ **Replies:** 0\ **Last updated:** [February 3, 2023, 5:02pm UTC](https://discuss.elastic.co/t/processing-a-taxii-feed/324678 "2023-02-03T17:02:48Z")
I have a data feed that needs to support TAXII 2.1 but also needs to handle certificate based authentication. Does elastic have support for this? Thanks! --- ## [How much is xpack-siem, please tell me , thanks](https://discuss.elastic.co/t/how-much-is-xpack-siem-please-tell-me-thanks/324375)
**Author:** [@dingyouqiang](https://discuss.elastic.co/u/dingyouqiang)\ **Replies:** 2\ **Last updated:** [February 1, 2023, 1:04am UTC](https://discuss.elastic.co/t/how-much-is-xpack-siem-please-tell-me-thanks/324375 "2023-02-01T01:04:23Z")
i don't know the price of xpack and i never use them. I want to know the price , and tell my boss. thanks --- ## [How to ingest firewall log data to elastic security](https://discuss.elastic.co/t/how-to-ingest-firewall-log-data-to-elastic-security/324138)
**Author:** [@yak990](https://discuss.elastic.co/u/yak990)\ **Replies:** 2\ **Last updated:** [January 31, 2023, 4:36pm UTC](https://discuss.elastic.co/t/how-to-ingest-firewall-log-data-to-elastic-security/324138 "2023-01-31T16:36:38Z")
I've figured out how to parse my firewall logs with logstash, and they are in ECS format now. I can create a new index and edit some settings to get it to show in discover. How do I add the new index pattern to the log… --- ## [Adding rule exceptions](https://discuss.elastic.co/t/adding-rule-exceptions/323422)
**Author:** [@yak990](https://discuss.elastic.co/u/yak990)\ **Replies:** 1\ **Last updated:** [January 31, 2023, 4:09pm UTC](https://discuss.elastic.co/t/adding-rule-exceptions/323422 "2023-01-31T16:09:36Z")
When adding rule exceptions from existing alerts, it would be great if it auto copied the attributes from the alert into the proposed exception. Right now, I copy down all the relevant attributes into a notebook, and th… --- ## [Log Source](https://discuss.elastic.co/t/log-source/324249)
**Author:** [@Phoenix1](https://discuss.elastic.co/u/Phoenix1)\ **Replies:** 3\ **Last updated:** [January 31, 2023, 7:25am UTC](https://discuss.elastic.co/t/log-source/324249 "2023-01-31T07:25:27Z")
How to get the list of all Log sources ingestng logs in Elastic security. --- ## [Adding Fleet Server failed because “x509: certificate signed by unknown authority“](https://discuss.elastic.co/t/adding-fleet-server-failed-because-x509-certificate-signed-by-unknown-authority/323157)
**Author:** [@maof97](https://discuss.elastic.co/u/maof97)\ **Replies:** 5\ **Last updated:** [January 30, 2023, 2:52pm UTC](https://discuss.elastic.co/t/adding-fleet-server-failed-because-x509-certificate-signed-by-unknown-authority/323157 "2023-01-30T14:52:52Z")
Hello, I tried to add a fleet server today on a CentOS Server. Because I don’t want to add Agents with the —insecure flag anymore, I followed this documentation step by step: I created the ca.crt that signed the fleet… --- ## [Exception in fleet server and unable to receive logs](https://discuss.elastic.co/t/exception-in-fleet-server-and-unable-to-receive-logs/323991)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 1\ **Last updated:** [January 26, 2023, 6:00am UTC](https://discuss.elastic.co/t/exception-in-fleet-server-and-unable-to-receive-logs/323991 "2023-01-26T06:00:26Z")
Hi Team, I am trying to make the fleet server up however getting error in file and I am unable to decode it. Can someone please help? {"log.level":"error","service.name":"fleet-server","service.name":"fleet-server","fl… --- ## [Elastic Endpoint Crashes and digital signature error](https://discuss.elastic.co/t/elastic-endpoint-crashes-and-digital-signature-error/323869)
**Author:** [@Global\_Helpdesk](https://discuss.elastic.co/u/Global_Helpdesk)\ **Replies:** 2\ **Last updated:** [January 25, 2023, 2:32pm UTC](https://discuss.elastic.co/t/elastic-endpoint-crashes-and-digital-signature-error/323869 "2023-01-25T14:32:22Z")
Hello, I am seeing a problem with the Elastic Endpoint service on a couple of windows servers. When trying to start the service we get the error: The Elastic Endpoint service failed to start due to the following error:… --- ## [Detecting inactive users in Active Directory](https://discuss.elastic.co/t/detecting-inactive-users-in-active-directory/323650)
**Author:** [@Elnur\_Abbasov](https://discuss.elastic.co/u/Elnur_Abbasov)\ **Replies:** 5\ **Last updated:** [January 25, 2023, 12:29am UTC](https://discuss.elastic.co/t/detecting-inactive-users-in-active-directory/323650 "2023-01-25T00:29:39Z")
Hey All, I need to detect inactive users in Active Directory using Elastic SIEM. Any ideas how can I do that using EQL? I implemented the detection login in Splunk by using lookup files where I write to a lookup file al… --- ## [Mapper \[signal.ancestors.index\] cannot be changed from type \[text\] to \[keyword\]](https://discuss.elastic.co/t/mapper-signal-ancestors-index-cannot-be-changed-from-type-text-to-keyword/323331)
**Author:** [@Enrico\_Pasqualotto](https://discuss.elastic.co/u/Enrico_Pasqualotto)\ **Replies:** 8\ **Last updated:** [January 24, 2023, 2:13pm UTC](https://discuss.elastic.co/t/mapper-signal-ancestors-index-cannot-be-changed-from-type-text-to-keyword/323331 "2023-01-24T14:13:03Z")
Hello, probably after an upgrade (current ver. 7.17.6) every time we accesso to alerts/rules of Security section we got the following error: { "name": "Error", "body": { "message": "illegal\_argument\_exception: mapper… --- ## [VSS errors with endpoint](https://discuss.elastic.co/t/vss-errors-with-endpoint/323533)
**Author:** [@yak990](https://discuss.elastic.co/u/yak990)\ **Replies:** 2\ **Last updated:** [January 20, 2023, 6:55pm UTC](https://discuss.elastic.co/t/vss-errors-with-endpoint/323533 "2023-01-20T18:55:18Z")
I get the error below in my application event log several times a minute at times if the endpoint features are enabled. It's a conflict with macrium reflect. To reproduce: Install free trial of macrium: Macrium Softwa… --- ## [Issues with Exception lists automatically combining rules](https://discuss.elastic.co/t/issues-with-exception-lists-automatically-combining-rules/323106)
**Author:** [@aforfot](https://discuss.elastic.co/u/aforfot)\ **Replies:** 5\ **Last updated:** [January 19, 2023, 6:39pm UTC](https://discuss.elastic.co/t/issues-with-exception-lists-automatically-combining-rules/323106 "2023-01-19T18:39:52Z")
When creating multiple Rules in Elastic Security we have started to notice an issue where exception list items created for one specific rule will also affect other rules. In our case the issue affects 2 specific rules th… --- ## [Alert actions - how to kill process?](https://discuss.elastic.co/t/alert-actions-how-to-kill-process/323366)
**Author:** [@yak990](https://discuss.elastic.co/u/yak990)\ **Replies:** 1\ **Last updated:** [January 18, 2023, 2:30pm UTC](https://discuss.elastic.co/t/alert-actions-how-to-kill-process/323366 "2023-01-18T14:30:15Z")
Several of these alert rules are severe enough that I would want to kill the process that generated the alert. Suspicious .NET Reflection via PowerShell would be an example. It would be nice to be able to kill the proc… --- ## [Indicator Match detection rules using Value Lists not working in 8.6.0](https://discuss.elastic.co/t/indicator-match-detection-rules-using-value-lists-not-working-in-8-6-0/323192)
**Author:** [@W24800](https://discuss.elastic.co/u/W24800)\ **Replies:** 1\ **Last updated:** [January 18, 2023, 11:36am UTC](https://discuss.elastic.co/t/indicator-match-detection-rules-using-value-lists-not-working-in-8-6-0/323192 "2023-01-18T11:36:28Z")
Hello, when I create an Indicator Match detection rule using an uploaded value list (following instructions from Create a detection rule | Elastic Security Solution \[8.11\] | Elastic), the rule fails to execute with the f… --- ## [Excessive denied SMB traffic](https://discuss.elastic.co/t/excessive-denied-smb-traffic/323184)
**Author:** [@Abulfaz](https://discuss.elastic.co/u/Abulfaz)\ **Replies:** 1\ **Last updated:** [January 18, 2023, 12:00am UTC](https://discuss.elastic.co/t/excessive-denied-smb-traffic/323184 "2023-01-18T00:00:55Z")
How should I write Elastic rule that detect if excessive denied SMB traffic from a single host? --- ## [Detection rules - new installation](https://discuss.elastic.co/t/detection-rules-new-installation/323165)
**Author:** [@hobbyist](https://discuss.elastic.co/u/hobbyist)\ **Replies:** 1\ **Last updated:** [January 14, 2023, 1:57am UTC](https://discuss.elastic.co/t/detection-rules-new-installation/323165 "2023-01-14T01:57:38Z")
How do I enable the Detection Engine and import the baseline detection rules in Kibana? I installed the oss version of 7.10.2 on an ubuntu server version 22.04. --- ## [Elastic Endpoint - Questionable snaps causing problems](https://discuss.elastic.co/t/elastic-endpoint-questionable-snaps-causing-problems/322582)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 3\ **Last updated:** [January 12, 2023, 8:48pm UTC](https://discuss.elastic.co/t/elastic-endpoint-questionable-snaps-causing-problems/322582 "2023-01-12T20:48:43Z")
Why is Endpoint creating snap shots on Windows Server 2016/19? This started with 8.5.1+ and has seriously messed up some of my legacy backups that relay on the windows snap shots manager to process. I've had several fail… --- ## [Network Scan](https://discuss.elastic.co/t/network-scan/322835)
**Author:** [@Gurban](https://discuss.elastic.co/u/Gurban)\ **Replies:** 5\ **Last updated:** [January 12, 2023, 5:43pm UTC](https://discuss.elastic.co/t/network-scan/322835 "2023-01-12T17:43:35Z")
How should I write Elastic rule that detect if more than 10 unique destinations were accessed from same source IP within 1 minutes. Best Regards --- ## [ML Unsupervised question](https://discuss.elastic.co/t/ml-unsupervised-question/322437)
**Author:** [@alex\_su](https://discuss.elastic.co/u/alex_su)\ **Replies:** 2\ **Last updated:** [January 9, 2023, 4:40pm UTC](https://discuss.elastic.co/t/ml-unsupervised-question/322437 "2023-01-09T16:40:45Z")
Hi, as i know es provide ml to detect unusual event, like "Unusual Windows Username" and another exapmle is " Unusual Hour for a User to Logon". I have question about unusual meaning as belows. how to build this ml ? … --- ## [Unable to run Endpoint 8.4 on a Ubuntu 20.04 host hardened with CIS Level 2](https://discuss.elastic.co/t/unable-to-run-endpoint-8-4-on-a-ubuntu-20-04-host-hardened-with-cis-level-2/318559)
**Author:** [@dapster](https://discuss.elastic.co/u/dapster)\ **Replies:** 16\ **Last updated:** [January 9, 2023, 3:57pm UTC](https://discuss.elastic.co/t/unable-to-run-endpoint-8-4-on-a-ubuntu-20-04-host-hardened-with-cis-level-2/318559 "2023-01-09T15:57:38Z")
Hi, I am encountering difficulties to properly run Endpoint (deployed thanks to Fleet Server) on a Ubuntu 20.04 host (hardened with CIS Level 2 and I suspect the issue to be related to system hardening). When I run ela… --- ## [About Fleet Agents categority](https://discuss.elastic.co/t/about-fleet-agents-categority/321844)
**Author:** [@cybersirp](https://discuss.elastic.co/u/cybersirp)\ **Replies:** 1\ **Last updated:** [January 9, 2023, 9:38am UTC](https://discuss.elastic.co/t/about-fleet-agents-categority/321844 "2023-01-09T09:38:33Z")
How is the consumption of resources related to the number of agents that we deploy in our organizations calculated? Is there a formula to be able to have an approximate amount of resources needed for each agent that wil… --- ## [Elastic with salesforce integration](https://discuss.elastic.co/t/elastic-with-salesforce-integration/320851)
**Author:** [@Siva\_Suneel](https://discuss.elastic.co/u/Siva_Suneel)\ **Replies:** 1\ **Last updated:** [January 3, 2023, 7:32pm UTC](https://discuss.elastic.co/t/elastic-with-salesforce-integration/320851 "2023-01-03T19:32:57Z")
Facing errors while integration with salesforce. Deployment error. Has anyone worked on it before? --- ## [Prebuilt security detection rules not showing any alters](https://discuss.elastic.co/t/prebuilt-security-detection-rules-not-showing-any-alters/320541)
**Author:** [@satendra1987](https://discuss.elastic.co/u/satendra1987)\ **Replies:** 1\ **Last updated:** [December 30, 2022, 12:00am UTC](https://discuss.elastic.co/t/prebuilt-security-detection-rules-not-showing-any-alters/320541 "2022-12-30T00:00:52Z")
Hi, i am trying to work on elasticsearch security. i have installed elastic agent using fleet. Now i have enabled prebuilt security detection rules and status shows as successful when rules are executed however i dont s… --- ## [Macos M1 Ventura 13.0.1 Elastic agent install fail](https://discuss.elastic.co/t/macos-m1-ventura-13-0-1-elastic-agent-install-fail/319262)
**Author:** [@xqaiviwjxzw](https://discuss.elastic.co/u/xqaiviwjxzw)\ **Replies:** 9\ **Last updated:** [December 28, 2022, 5:27pm UTC](https://discuss.elastic.co/t/macos-m1-ventura-13-0-1-elastic-agent-install-fail/319262 "2022-12-28T17:27:57Z")
I installed the elastic agent on macos Ventura 13.0.1 using the command line and the installation failed showing： panic: getwd: invalid argument goroutine 1 \[running\]: github.com/elastic/elastic-agent/internal/pkg/age… --- ## [Alerts on SIEM](https://discuss.elastic.co/t/alerts-on-siem/321297)
**Author:** [@Samara\_Brych](https://discuss.elastic.co/u/Samara_Brych)\ **Replies:** 2\ **Last updated:** [December 27, 2022, 6:34pm UTC](https://discuss.elastic.co/t/alerts-on-siem/321297 "2022-12-27T18:34:27Z")
If I mark an alert as ackowledged on Elastic SIEM, and the alert occurs again, it will notify me again or never more will display on open alerts? --- ## [CSPM third Party](https://discuss.elastic.co/t/cspm-third-party/321805)
**Author:** [@Dea\_Agra](https://discuss.elastic.co/u/Dea_Agra)\ **Replies:** 1\ **Last updated:** [December 25, 2022, 11:52pm UTC](https://discuss.elastic.co/t/cspm-third-party/321805 "2022-12-25T23:52:06Z")
Hi Elastic Team, We want to integrate our Elastic SIEM with CSPM third part tools, is there any tool recommandation taht we can integrate with our Elastic SIEM? --- ## [Agent Spoofing - Multiple Hosts Using Same Agent after update to 8.5.3](https://discuss.elastic.co/t/agent-spoofing-multiple-hosts-using-same-agent-after-update-to-8-5-3/321276)
**Author:** [@Paradox](https://discuss.elastic.co/u/Paradox)\ **Replies:** 1\ **Last updated:** [December 25, 2022, 11:39pm UTC](https://discuss.elastic.co/t/agent-spoofing-multiple-hosts-using-same-agent-after-update-to-8-5-3/321276 "2022-12-25T23:39:33Z")
Hello, since the update to ELS 8.5.3 we receive "Agent Spoofing - Multiple Hosts Using Same Agent" messages. We were able to narrow down the message to be related to the DHCP integration. As soon as this is activated… --- ## [Elastic Agent Updating forever](https://discuss.elastic.co/t/elastic-agent-updating-forever/321935)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 1\ **Last updated:** [December 25, 2022, 10:58pm UTC](https://discuss.elastic.co/t/elastic-agent-updating-forever/321935 "2022-12-25T22:58:23Z")
Hello there, I´m trying to install elastic agent on windows server box but for some reason appears to be something related with sc.exe command. Follow the logs from the agent on this server: \[elastic\_agent\]\[error\] Ela… --- ## [Getting SIEM alerts through API](https://discuss.elastic.co/t/getting-siem-alerts-through-api/321603)
**Author:** [@reg\_reginald](https://discuss.elastic.co/u/reg_reginald)\ **Replies:** 4\ **Last updated:** [December 21, 2022, 7:13pm UTC](https://discuss.elastic.co/t/getting-siem-alerts-through-api/321603 "2022-12-21T19:13:21Z")
Hello, Is it possible to get alerts from Kibana SIEM through an api? it seems like \:\/api/detection\_engine/signals could be a way but there's no example with individual alerts, just an aggregation. … [Previous page](https://discuss.elastic.co/c/security/83.md?page=25) [Next page](https://discuss.elastic.co/c/security/83.md?page=27)