# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=27 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 28 --- ## [\[Integration\] Facing error while adding transform in integration package](https://discuss.elastic.co/t/integration-facing-error-while-adding-transform-in-integration-package/320746)
**Author:** [@Alex\_R](https://discuss.elastic.co/u/Alex_R)\ **Replies:** 4\ **Last updated:** [December 21, 2022, 5:05am UTC](https://discuss.elastic.co/t/integration-facing-error-while-adding-transform-in-integration-package/320746 "2022-12-21T05:05:02Z")
I have referred elastic-package spec to ship transform along with integration package. However, I am not able to install integration package when added transform under /root/integrations/packages/my\_package/elasticsearch… --- ## [Elastic Endpoint File Monitoring vs Elastic Agent File Integrity Monitoring Integration](https://discuss.elastic.co/t/elastic-endpoint-file-monitoring-vs-elastic-agent-file-integrity-monitoring-integration/321599)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 1\ **Last updated:** [December 20, 2022, 2:07am UTC](https://discuss.elastic.co/t/elastic-endpoint-file-monitoring-vs-elastic-agent-file-integrity-monitoring-integration/321599 "2022-12-20T02:07:13Z")
Hi All, I was curious if anyone knows the answer to this question, what are the differences between the Elastic Endpoint Security File Monitoring, and the Elastic Agent File Integrity Monitoring Integration? Are they i… --- ## [Customized UI for Elastic Security as SIEM](https://discuss.elastic.co/t/customized-ui-for-elastic-security-as-siem/321360)
**Author:** [@camiyu1](https://discuss.elastic.co/u/camiyu1)\ **Replies:** 2\ **Last updated:** [December 16, 2022, 12:54pm UTC](https://discuss.elastic.co/t/customized-ui-for-elastic-security-as-siem/321360 "2022-12-16T12:54:51Z")
I am working on deploying Elastic Security in an on-prem environment. After installing Elasticsearch, Kibana, Logstash, I managed to configure to ingest different log sources such as firewall, proxy gateway, intrusion d… --- ## [RuleDataWriteDisabledError ELK v8.5](https://discuss.elastic.co/t/ruledatawritedisablederror-elk-v8-5/320031)
**Author:** [@theacodes](https://discuss.elastic.co/u/theacodes)\ **Replies:** 5\ **Last updated:** [December 16, 2022, 5:05am UTC](https://discuss.elastic.co/t/ruledatawritedisablederror-elk-v8-5/320031 "2022-12-16T05:05:54Z")
getting this error Bulk Indexing of signals failed: RuleDataWriteDisabledError: Rule registry writing is disabled due to an error during Rule Data Client initialization. After I updated ELK from 8.4 to 8.5 --- ## [Open Cybersecurity Schema Framework](https://discuss.elastic.co/t/open-cybersecurity-schema-framework/320290)
**Author:** [@grandmasterv](https://discuss.elastic.co/u/grandmasterv)\ **Replies:** 2\ **Last updated:** [December 13, 2022, 2:41am UTC](https://discuss.elastic.co/t/open-cybersecurity-schema-framework/320290 "2022-12-13T02:41:45Z")
Hello Elastic Community, With the release of the Open Cybersecurity Schema Framework, I was wondering is there was any discussion happening on aligning the Elastic Common Schema with it? The goals of the OCSF seem simi… --- ## [Does Cloud Workload Protection requires license?](https://discuss.elastic.co/t/does-cloud-workload-protection-requires-license/320799)
**Author:** [@German\_Bravo](https://discuss.elastic.co/u/German_Bravo)\ **Replies:** 3\ **Last updated:** [December 12, 2022, 6:54pm UTC](https://discuss.elastic.co/t/does-cloud-workload-protection-requires-license/320799 "2022-12-12T18:54:16Z")
Hello, I just updated to v8.x from 7.x, and Im curious about Cloud Workload Protection. I saw that it is necessary to have a license for CIS benchmarking Kubernetes (findings section in Elastic Security), but for protec… --- ## [Elastic Endpoint respond not working](https://discuss.elastic.co/t/elastic-endpoint-respond-not-working/320966)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 1\ **Last updated:** [December 12, 2022, 2:54pm UTC](https://discuss.elastic.co/t/elastic-endpoint-respond-not-working/320966 "2022-12-12T14:54:38Z")
Hi all I'm trying the elastic endpoint security and i see that there is a respond option for the endpoint. But mine got greyout and it said my current version of the Agent is not supported and i need to upgrade the ver… --- ## [Difference between using elastic cloud (aws) and using elastic from AWS marketplace](https://discuss.elastic.co/t/difference-between-using-elastic-cloud-aws-and-using-elastic-from-aws-marketplace/320898)
**Author:** [@Zay\_Lin\_Htun](https://discuss.elastic.co/u/Zay_Lin_Htun)\ **Replies:** 3\ **Last updated:** [December 11, 2022, 6:22am UTC](https://discuss.elastic.co/t/difference-between-using-elastic-cloud-aws-and-using-elastic-from-aws-marketplace/320898 "2022-12-11T06:22:18Z")
Hi all, I want to know the details information about difference between using elastic cloud (aws) and using elastic from our AWS marketplace? --- ## [No reply from Elastic Vendor](https://discuss.elastic.co/t/no-reply-from-elastic-vendor/320900)
**Author:** [@Zay\_Lin\_Htun](https://discuss.elastic.co/u/Zay_Lin_Htun)\ **Replies:** 2\ **Last updated:** [December 11, 2022, 3:28am UTC](https://discuss.elastic.co/t/no-reply-from-elastic-vendor/320900 "2022-12-11T03:28:58Z")
Dear all, I already contacted via web and contact email about Elastic Security (Cloud). But I have no reply from them and I am planning to use elastic security (cloud: gold subscription). Please share me some contact w… --- ## [Elastic endpoint security blocklist process delete the binary file](https://discuss.elastic.co/t/elastic-endpoint-security-blocklist-process-delete-the-binary-file/320868)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 7\ **Last updated:** [December 10, 2022, 4:00pm UTC](https://discuss.elastic.co/t/elastic-endpoint-security-blocklist-process-delete-the-binary-file/320868 "2022-12-10T16:00:06Z")
Hi all I have a case using the elastic endpoint. I tried using the blocklist in elastic endpoint to block the process /bin/ls. After the policy got installed the binary file in /bin/ls disaprear and i cannot execute l… --- ## [Missing required fields in duplicated rules](https://discuss.elastic.co/t/missing-required-fields-in-duplicated-rules/320874)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [December 9, 2022, 10:22pm UTC](https://discuss.elastic.co/t/missing-required-fields-in-duplicated-rules/320874 "2022-12-09T22:22:09Z")
When I duplicate a rule, I don't immediately see an option to select required fields? (I could be looking over it?) --- ## [What if there are no rules enabled?](https://discuss.elastic.co/t/what-if-there-are-no-rules-enabled/320714)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 1\ **Last updated:** [December 8, 2022, 3:48am UTC](https://discuss.elastic.co/t/what-if-there-are-no-rules-enabled/320714 "2022-12-08T03:48:24Z")
Will Elastic Security / Endpoint Protection still protect/prevent malware without the rules enabled in the SIEM? --- ## [Best way to analyze Event Correlation Sequence detections](https://discuss.elastic.co/t/best-way-to-analyze-event-correlation-sequence-detections/320497)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 5\ **Last updated:** [December 7, 2022, 8:20pm UTC](https://discuss.elastic.co/t/best-way-to-analyze-event-correlation-sequence-detections/320497 "2022-12-07T20:20:57Z")
Hey, I want to analyse an Event Correlation rule detection (EQL) in Elastic SIEM. However, for sequence-type EQL queries, the alert details and SIEM app don't show me all the information I need to do my analysis. Consid… --- ## [Is Kibana EQL Rule Using Async Search?](https://discuss.elastic.co/t/is-kibana-eql-rule-using-async-search/320687)
**Author:** [@davendu](https://discuss.elastic.co/u/davendu)\ **Replies:** 4\ **Last updated:** [December 7, 2022, 3:55pm UTC](https://discuss.elastic.co/t/is-kibana-eql-rule-using-async-search/320687 "2022-12-07T15:55:05Z")
Hi everyone, Similar to this thread, I also was notified by error Request timed out like the following debug log says: { ... "message":"Changing rule status to \\"failed\\". An error occurred during rule execution: messa… --- ## [What is External Alerts Detection Rule?](https://discuss.elastic.co/t/what-is-external-alerts-detection-rule/316817)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 4\ **Last updated:** [December 5, 2022, 1:53pm UTC](https://discuss.elastic.co/t/what-is-external-alerts-detection-rule/316817 "2022-12-05T13:53:19Z")
Hello, what exactly is "External Alerts" in the SIEM rules? It doesn't do anything for us. --- ## [Recommended rules for NextronSystems/APTSimulator](https://discuss.elastic.co/t/recommended-rules-for-nextronsystems-aptsimulator/320105)
**Author:** [@nikAizuddin](https://discuss.elastic.co/u/nikAizuddin)\ **Replies:** 3\ **Last updated:** [December 1, 2022, 12:26pm UTC](https://discuss.elastic.co/t/recommended-rules-for-nextronsystems-aptsimulator/320105 "2022-12-01T12:26:39Z")
Hi, I'm using Elastic Stack 8.3.3 with Basic License. I want test Kibana alerts for APT by detecting NextronSystems/APTSimulator activity. By default, Elastic include 716 rules: May I know which rules are recommend… --- ## [\[again\] Endpoint security immediately degraded](https://discuss.elastic.co/t/again-endpoint-security-immediately-degraded/318765)
**Author:** [@CrazyDumpling](https://discuss.elastic.co/u/CrazyDumpling)\ **Replies:** 8\ **Last updated:** [November 29, 2022, 3:35pm UTC](https://discuss.elastic.co/t/again-endpoint-security-immediately-degraded/318765 "2022-11-29T15:35:46Z")
Hello. I know this has been asked a million times here, but i've tried everything i know and i still can't get it to work. I have an Agent Policies with Network Packet Capture, Elastic Defend, and System integrations. … --- ## [Can I still use Threat Intelligence?](https://discuss.elastic.co/t/can-i-still-use-threat-intelligence/319962)
**Author:** [@maof97](https://discuss.elastic.co/u/maof97)\ **Replies:** 6\ **Last updated:** [November 29, 2022, 12:06am UTC](https://discuss.elastic.co/t/can-i-still-use-threat-intelligence/319962 "2022-11-29T00:06:20Z")
Hello Community, I just upgraded one of my test machines from 8.1.2 to 8.5.2 and I noticed that there is now a menu in the security section called "Intelligence", but when I click on it it says "Start a free trial or up… --- ## [KQL Comprehensive Tutorial on Event Correlation Rules](https://discuss.elastic.co/t/kql-comprehensive-tutorial-on-event-correlation-rules/318669)
**Author:** [@ElasticUser11](https://discuss.elastic.co/u/ElasticUser11)\ **Replies:** 3\ **Last updated:** [November 28, 2022, 8:05pm UTC](https://discuss.elastic.co/t/kql-comprehensive-tutorial-on-event-correlation-rules/318669 "2022-11-28T20:05:13Z")
I need to build some rather complex rules, but I'm just getting started with KQL. I haven't found any in-depth comprehensive tuts out there on event correlation. Everything is always brief and basic. Anyone know of any g… --- ## [EQL without pre defined field values](https://discuss.elastic.co/t/eql-without-pre-defined-field-values/318871)
**Author:** [@frederikvandeputte](https://discuss.elastic.co/u/frederikvandeputte)\ **Replies:** 1\ **Last updated:** [November 28, 2022, 7:45pm UTC](https://discuss.elastic.co/t/eql-without-pre-defined-field-values/318871 "2022-11-28T19:45:57Z")
Hi I am in a process of migrating correlation rules from a McAfee SIEM to Elastic Security and I am checking if it is possible to build the following use case in EQL: I am looking at events generated by a security solu… --- ## [Limo.anomali.com Threat Intelligence End of Life](https://discuss.elastic.co/t/limo-anomali-com-threat-intelligence-end-of-life/319951)
**Author:** [@Johnf](https://discuss.elastic.co/u/Johnf)\ **Replies:** 0\ **Last updated:** [November 28, 2022, 12:36pm UTC](https://discuss.elastic.co/t/limo-anomali-com-threat-intelligence-end-of-life/319951 "2022-11-28T12:36:31Z")
I just noticed that the Filebeat Threat Intelligence module setting for limo.anomali.com was not working. Research indicated that the site is at End of Life Aug 2022. I did submit a request for the follow on replacement … --- ## [Dynamic rule risk score](https://discuss.elastic.co/t/dynamic-rule-risk-score/319428)
**Author:** [@Faycal\_B](https://discuss.elastic.co/u/Faycal_B)\ **Replies:** 0\ **Last updated:** [November 21, 2022, 11:09am UTC](https://discuss.elastic.co/t/dynamic-rule-risk-score/319428 "2022-11-21T11:09:15Z")
The risk score is defined in the rule but cant be influenced by the alert itself, is there a way other than external API workflows ? --- ## [Threatintel module filebeat](https://discuss.elastic.co/t/threatintel-module-filebeat/317858)
**Author:** [@emmanuel\_stevens\_LED](https://discuss.elastic.co/u/emmanuel_stevens_LED)\ **Replies:** 6\ **Last updated:** [November 18, 2022, 4:25pm UTC](https://discuss.elastic.co/t/threatintel-module-filebeat/317858 "2022-11-18T16:25:07Z")
Hello, I activate the theatintel module for filebeat but still doesn t get any datas i have this in my logs ''' Nov 1 03:00:02 hostname filebeat\[560069\]: {"log.level":"info","@timestamp":"2022-11-01T03:00:02.308Z"… --- ## [Index for rule erros](https://discuss.elastic.co/t/index-for-rule-erros/319064)
**Author:** [@kmz161](https://discuss.elastic.co/u/kmz161)\ **Replies:** 2\ **Last updated:** [November 18, 2022, 2:56pm UTC](https://discuss.elastic.co/t/index-for-rule-erros/319064 "2022-11-18T14:56:05Z")
Hello! I need create dashboard, which contains rule errors. Which index does contain rule errors? --- ## [【Windows】pipe\\\\elastic-agent-system: Access is denied](https://discuss.elastic.co/t/windows-pipe-elastic-agent-system-access-is-denied/316344)
**Author:** [@xqaiviwjxzw](https://discuss.elastic.co/u/xqaiviwjxzw)\ **Replies:** 4\ **Last updated:** [November 18, 2022, 8:09am UTC](https://discuss.elastic.co/t/windows-pipe-elastic-agent-system-access-is-denied/316344 "2022-11-18T08:09:59Z")
I am installing Elastic Agent 8.4.1 on a Win10 system using the command line and I get the following error and the server fleet keeps showing updates, how do I fix it? The error is displayed： Error: failed to communica… --- ## [Import Yara to elastic instance in cloud](https://discuss.elastic.co/t/import-yara-to-elastic-instance-in-cloud/319050)
**Author:** [@Idan\_Abramovich](https://discuss.elastic.co/u/Idan_Abramovich)\ **Replies:** 1\ **Last updated:** [November 16, 2022, 10:05pm UTC](https://discuss.elastic.co/t/import-yara-to-elastic-instance-in-cloud/319050 "2022-11-16T22:05:54Z")
Hello all , How do I import Yara rules into our instance ? any direction or clue? thank you --- ## [Elastic support STIX and/or TAXII](https://discuss.elastic.co/t/elastic-support-stix-and-or-taxii/319076)
**Author:** [@oyuskeseliev](https://discuss.elastic.co/u/oyuskeseliev)\ **Replies:** 2\ **Last updated:** [November 16, 2022, 3:01pm UTC](https://discuss.elastic.co/t/elastic-support-stix-and-or-taxii/319076 "2022-11-16T15:01:40Z")
Hi all, i’m trying to find out if Elastic has support for STIX/TAXII. I do not see any info about this in the documentation, does anyone know? regards Ognyan --- ## [Problems With Import-Rules and Create-Rules](https://discuss.elastic.co/t/problems-with-import-rules-and-create-rules/317410)
**Author:** [@Omar\_E](https://discuss.elastic.co/u/Omar_E)\ **Replies:** 1\ **Last updated:** [November 12, 2022, 10:51pm UTC](https://discuss.elastic.co/t/problems-with-import-rules-and-create-rules/317410 "2022-11-12T22:51:34Z")
I am currently trying to use the detection-rules CLI tool to import or create-rules from a JSON file. However, I keep getting the error below. Does anyone know how to fix this? --- ## [Unable to get rule triggered](https://discuss.elastic.co/t/unable-to-get-rule-triggered/317448)
**Author:** [@GUruisaDog](https://discuss.elastic.co/u/GUruisaDog)\ **Replies:** 6\ **Last updated:** [November 10, 2022, 8:53pm UTC](https://discuss.elastic.co/t/unable-to-get-rule-triggered/317448 "2022-11-10T20:53:34Z")
My current version of ES Security is on 7.16.1. I was trying to setup a threshold rule, and everything goes well. I could see the result from the preview and such. However, after created the rule and activate the rule, n… --- ## [Webhook with variables from Query DSL hits](https://discuss.elastic.co/t/webhook-with-variables-from-query-dsl-hits/318319)
**Author:** [@Alex\_Molina\_Bastos](https://discuss.elastic.co/u/Alex_Molina_Bastos)\ **Replies:** 3\ **Last updated:** [November 10, 2022, 4:22pm UTC](https://discuss.elastic.co/t/webhook-with-variables-from-query-dsl-hits/318319 "2022-11-10T16:22:35Z")
Hi, I am trying to create a rule that when triggered gets a variable, an IP in this case, from Query DSL and sends this variable through a webhook. I should be available to get an array of these variables if there are … [Previous page](https://discuss.elastic.co/c/security/83.md?page=26) [Next page](https://discuss.elastic.co/c/security/83.md?page=28)