# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=28 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 29 --- ## [Exporting rules to ndjson generates incomplete file](https://discuss.elastic.co/t/exporting-rules-to-ndjson-generates-incomplete-file/318214)
**Author:** [@ElasticUser11](https://discuss.elastic.co/u/ElasticUser11)\ **Replies:** 4\ **Last updated:** [November 9, 2022, 2:52pm UTC](https://discuss.elastic.co/t/exporting-rules-to-ndjson-generates-incomplete-file/318214 "2022-11-09T14:52:06Z")
I'm trying to export all the 722 rules into an ndjson file, but the file is incomplete. There are two sets of rule: Elastic rules and Custom rules. I go to Security \> Overview \> Rules \> Select all 722 rules \> Bulk Actio… --- ## [Threshold rule can't group by with source.ip but only with source.ip.keyword](https://discuss.elastic.co/t/threshold-rule-cant-group-by-with-source-ip-but-only-with-source-ip-keyword/317761)
**Author:** [@Simone\_Calo](https://discuss.elastic.co/u/Simone_Calo)\ **Replies:** 10\ **Last updated:** [November 8, 2022, 11:35am UTC](https://discuss.elastic.co/t/threshold-rule-cant-group-by-with-source-ip-but-only-with-source-ip-keyword/317761 "2022-11-08T11:35:36Z")
My problem consists in defining a threshold rule in the group by field. I can only enter source.ip.keyword and not source.ip. The consequence of this is that the rule fails every time with the following error: Bu… --- ## [Input needed for Elastic's Cloud Security offerings!](https://discuss.elastic.co/t/input-needed-for-elastics-cloud-security-offerings/318056)
**Author:** [@danr](https://discuss.elastic.co/u/danr)\ **Replies:** 0\ **Last updated:** [November 2, 2022, 10:17pm UTC](https://discuss.elastic.co/t/input-needed-for-elastics-cloud-security-offerings/318056 "2022-11-02T22:17:57Z")
Hi Elastic community! I'm Dan-- I help out with our new cloud security capabilities where I focus on cloud threat detection, prevention & response. I'm looking to meet up with any Elastic users that might be: Thinking… --- ## [Default alert action?](https://discuss.elastic.co/t/default-alert-action/258805)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 3\ **Last updated:** [November 2, 2022, 6:13pm UTC](https://discuss.elastic.co/t/default-alert-action/258805 "2022-11-02T18:13:27Z")
Is there a way to set a default action in Elastic Siem? Manually setting up an action on 300+ rules is pretty raw! --- ## [Analyze Event Tool - Subgraph Extraction?](https://discuss.elastic.co/t/analyze-event-tool-subgraph-extraction/317149)
**Author:** [@Sheharyar\_Khalid](https://discuss.elastic.co/u/Sheharyar_Khalid)\ **Replies:** 1\ **Last updated:** [November 2, 2022, 1:12am UTC](https://discuss.elastic.co/t/analyze-event-tool-subgraph-extraction/317149 "2022-11-02T01:12:27Z")
Hello, I am trying to find event correlations using eql. For this I am using the eqlplayground.io with everything set to default. I am using the sample query given by eql: //This is a placeholder query, please feel fre… --- ## [Transport communication between node with opendistro and node with xpack fails](https://discuss.elastic.co/t/transport-communication-between-node-with-opendistro-and-node-with-xpack-fails/317550)
**Author:** [@Rineesh\_Nallatath](https://discuss.elastic.co/u/Rineesh_Nallatath)\ **Replies:** 4\ **Last updated:** [October 31, 2022, 2:00am UTC](https://discuss.elastic.co/t/transport-communication-between-node-with-opendistro-and-node-with-xpack-fails/317550 "2022-10-31T02:00:08Z")
We do have an elastic setup (not complete stack,but elastic clusters in two sites with CCR enabled) We want to migrate from opendistro to X-pack security also upgrade ES version from 7.3 to 7.17. We use our internal AP… --- ## [Issue creating index with alert](https://discuss.elastic.co/t/issue-creating-index-with-alert/317604)
**Author:** [@Florian-LB](https://discuss.elastic.co/u/Florian-LB)\ **Replies:** 2\ **Last updated:** [October 27, 2022, 3:14pm UTC](https://discuss.elastic.co/t/issue-creating-index-with-alert/317604 "2022-10-27T15:14:30Z")
Hi, I want to setup an alert when 3 login rejections occur on the same switch in order to get this info on my dashboard. I created a threshold rule “Alerte Brute Force Cisco” that raise an alert when 3 authentications … --- ## [Data Stream not found in Data Views](https://discuss.elastic.co/t/data-stream-not-found-in-data-views/317222)
**Author:** [@sakib3833](https://discuss.elastic.co/u/sakib3833)\ **Replies:** 1\ **Last updated:** [October 27, 2022, 2:22pm UTC](https://discuss.elastic.co/t/data-stream-not-found-in-data-views/317222 "2022-10-27T14:22:55Z")
I use Microsoft Defender Endpoint integration to collect logs. The agent installed perfectly and the other ID and secret key put accordingly. In the Index management section it shows that it creates Data Stream. But… --- ## [Problem with Endpoint Security Initiation](https://discuss.elastic.co/t/problem-with-endpoint-security-initiation/316419)
**Author:** [@Patryk\_Ostrowski](https://discuss.elastic.co/u/Patryk_Ostrowski)\ **Replies:** 7\ **Last updated:** [October 27, 2022, 12:50pm UTC](https://discuss.elastic.co/t/problem-with-endpoint-security-initiation/316419 "2022-10-27T12:50:35Z")
Hello, I'm trying to initialize Security Endpoint on a Linux Ubuntu 20.04.4 LTS. After that I had a 13 problems for example: "Configure File Events Failure enabling file events; current state is disabled". I tried to di… --- ## [Security Rules with Endgame get an error](https://discuss.elastic.co/t/security-rules-with-endgame-get-an-error/317241)
**Author:** [@hermlam](https://discuss.elastic.co/u/hermlam)\ **Replies:** 3\ **Last updated:** [October 25, 2022, 3:30pm UTC](https://discuss.elastic.co/t/security-rules-with-endgame-get-an-error/317241 "2022-10-25T15:30:58Z")
Hi, In Elastic Security there are 4 rules which don’t work because Endgame is replaced by Endpoint. The rules are: Malware - Detected - Elastic Endgame Malware - Prevented - Elastic Endgame Ransomware - Detected - Ela… --- ## [Elastic Cases events trigger an external SOAR](https://discuss.elastic.co/t/elastic-cases-events-trigger-an-external-soar/316999)
**Author:** [@yzaritskyi](https://discuss.elastic.co/u/yzaritskyi)\ **Replies:** 3\ **Last updated:** [October 21, 2022, 1:08pm UTC](https://discuss.elastic.co/t/elastic-cases-events-trigger-an-external-soar/316999 "2022-10-21T13:08:43Z")
Hey all! I have a big question for you guys. Does anybody know about the opportunity to trigger an external API from the Elastic Case? I mean, Is there a way to implement some webhook or index in elastic that could col… --- ## [Elastic Agent defunct on fleet server and clients](https://discuss.elastic.co/t/elastic-agent-defunct-on-fleet-server-and-clients/305803)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 20\ **Last updated:** [October 21, 2022, 10:09am UTC](https://discuss.elastic.co/t/elastic-agent-defunct-on-fleet-server-and-clients/305803 "2022-10-21T10:09:35Z")
Hello there, I have installed elastic-agent on a ubuntu-server box and when I list which process is running I get this: And then I realized that I got the same on the fleet server: This doesn´t look normal. Elas… --- ## [How to Correlate three events in EQL based on process and parent-process id?](https://discuss.elastic.co/t/how-to-correlate-three-events-in-eql-based-on-process-and-parent-process-id/316897)
**Author:** [@Sheharyar\_Khalid](https://discuss.elastic.co/u/Sheharyar_Khalid)\ **Replies:** 2\ **Last updated:** [October 20, 2022, 6:04pm UTC](https://discuss.elastic.co/t/how-to-correlate-three-events-in-eql-based-on-process-and-parent-process-id/316897 "2022-10-20T18:04:24Z")
I have log data in the following format on elasticsearch: 1- \["process\_name":"nginx", "process\_id":"1", "parent\_process\_id":"0", "syscall":"execv"\] 2- \["process\_name":"python", "process\_id":"2", "parent\_process\_id":"1"… --- ## [Unable to create Threshold rule](https://discuss.elastic.co/t/unable-to-create-threshold-rule/316262)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 1\ **Last updated:** [October 19, 2022, 10:35pm UTC](https://discuss.elastic.co/t/unable-to-create-threshold-rule/316262 "2022-10-19T22:35:12Z")
Hi Team, I am trying to write a threshold rule but failing to find the exact results. Can someone please help? I have nginx logs pouring in and wanted to setup the threshold alert so that if source.ip \>=750 from single … --- ## [How to enable Elastic Security](https://discuss.elastic.co/t/how-to-enable-elastic-security/316154)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 1\ **Last updated:** [October 19, 2022, 9:28pm UTC](https://discuss.elastic.co/t/how-to-enable-elastic-security/316154 "2022-10-19T21:28:23Z")
How to enable the default elastic security solution for non default indices (metric\*, filebeat\*..etc), which follow the ECS. Should be able to add the required indices in the security solution. --- ## [Count in Event Correlation](https://discuss.elastic.co/t/count-in-event-correlation/316197)
**Author:** [@sbianco1978](https://discuss.elastic.co/u/sbianco1978)\ **Replies:** 1\ **Last updated:** [October 18, 2022, 6:59pm UTC](https://discuss.elastic.co/t/count-in-event-correlation/316197 "2022-10-18T18:59:56Z")
Dears, I need to create an Event Correlation rule that performs a sequence that group by for a value and meantime count for another value. My scope is: sequence by user.name with maxspan=10m and count county \>= 2 se… --- ## [Tons of Alerts Using "Threat Intel Indicator Match"](https://discuss.elastic.co/t/tons-of-alerts-using-threat-intel-indicator-match/316783)
**Author:** [@Viral-Technology](https://discuss.elastic.co/u/Viral-Technology)\ **Replies:** 4\ **Last updated:** [October 18, 2022, 11:44am UTC](https://discuss.elastic.co/t/tons-of-alerts-using-threat-intel-indicator-match/316783 "2022-10-18T11:44:15Z")
Hello Elastic Community!! in the last few days I have received a ton of alerts using "Threat Intel Indicator match" it is matching specific ports with specific Ip addresses. however, after researching, I have found th… --- ## [Elastic On-primise price](https://discuss.elastic.co/t/elastic-on-primise-price/316380)
**Author:** [@laale](https://discuss.elastic.co/u/laale)\ **Replies:** 6\ **Last updated:** [October 13, 2022, 2:13pm UTC](https://discuss.elastic.co/t/elastic-on-primise-price/316380 "2022-10-13T14:13:30Z")
Hello community We want to use elastic endpoint security on-premise deployment so is there is any who knows the price of on-premise license? --- ## [Not able to view new features in Elastic security 8.4 i.e. (Respond Action0](https://discuss.elastic.co/t/not-able-to-view-new-features-in-elastic-security-8-4-i-e-respond-action0/316409)
**Author:** [@theacodes](https://discuss.elastic.co/u/theacodes)\ **Replies:** 2\ **Last updated:** [October 12, 2022, 12:19pm UTC](https://discuss.elastic.co/t/not-able-to-view-new-features-in-elastic-security-8-4-i-e-respond-action0/316409 "2022-10-12T12:19:31Z")
Hi! As shown in this video below section \[Purpose-built response automation interface \] Elastic Security 8.4: SOAR for modern security operations arms analysts to remediate threats faster | Elastic Blog where we go to … --- ## [No Host events Endpoint Security](https://discuss.elastic.co/t/no-host-events-endpoint-security/316046)
**Author:** [@shellcode](https://discuss.elastic.co/u/shellcode)\ **Replies:** 1\ **Last updated:** [October 10, 2022, 2:35pm UTC](https://discuss.elastic.co/t/no-host-events-endpoint-security/316046 "2022-10-10T14:35:09Z")
Hi all, I have installed Elastic Agent (enrolled with fleet and healthy) and Endpoint Security on a couple of hosts. All seems to work, except I am missing host events in the overview. There are events, but the messages… --- ## [Problem with alerting](https://discuss.elastic.co/t/problem-with-alerting/314115)
**Author:** [@RaonyO](https://discuss.elastic.co/u/RaonyO)\ **Replies:** 2\ **Last updated:** [October 7, 2022, 6:18pm UTC](https://discuss.elastic.co/t/problem-with-alerting/314115 "2022-10-07T18:18:02Z")
I have a delicate problem in the alert part of elastic security, first I am receiving logs from a security source, and I created a detection rule to alert every time such an event arrives, the rule works perfectly, it is… --- ## [Document enrichment via ingest pipeline or Indicator Match rule - which is preferable?](https://discuss.elastic.co/t/document-enrichment-via-ingest-pipeline-or-indicator-match-rule-which-is-preferable/315830)
**Author:** [@kossde](https://discuss.elastic.co/u/kossde)\ **Replies:** 1\ **Last updated:** [October 6, 2022, 3:15pm UTC](https://discuss.elastic.co/t/document-enrichment-via-ingest-pipeline-or-indicator-match-rule-which-is-preferable/315830 "2022-10-06T15:15:29Z")
Our elastic cluster is being used as a SIEM and is currently ingesting approximately 3x the data than originally scoped to ingest. It's working pretty hard. We have recently begun ingesting a MISP for enrichment and al… --- ## [Unable to set granular permissions for Endpoint Security module](https://discuss.elastic.co/t/unable-to-set-granular-permissions-for-endpoint-security-module/315866)
**Author:** [@bil15](https://discuss.elastic.co/u/bil15)\ **Replies:** 2\ **Last updated:** [October 5, 2022, 2:13pm UTC](https://discuss.elastic.co/t/unable-to-set-granular-permissions-for-endpoint-security-module/315866 "2022-10-05T14:13:25Z")
Hello! My SOC team is staring to use Elastic Stack for Security purposes, and we are planning to use both SIEM and Endpoint Security capabilities. We have T1 and T2 analysts, and I'd wanted to give them different permi… --- ## [All hosts Dashboard : host.name field is splitted when there is "-" (dash) in naming](https://discuss.elastic.co/t/all-hosts-dashboard-host-name-field-is-splitted-when-there-is-dash-in-naming/315879)
**Author:** [@4ourth](https://discuss.elastic.co/u/4ourth)\ **Replies:** 0\ **Last updated:** [October 5, 2022, 12:58pm UTC](https://discuss.elastic.co/t/all-hosts-dashboard-host-name-field-is-splitted-when-there-is-dash-in-naming/315879 "2022-10-05T12:58:07Z")
Hi, I am trying to configure Elastic Security. After parsing logs to the right fields, when I open Security \> Hosts \> All hosts it's splitting my hostnames if there is a "-" (dash. symbol ) in naming, and shows one host… --- ## [Elastic SIEM cloud data storage location? Canadian Data Residency](https://discuss.elastic.co/t/elastic-siem-cloud-data-storage-location-canadian-data-residency/315712)
**Author:** [@DabLab](https://discuss.elastic.co/u/DabLab)\ **Replies:** 1\ **Last updated:** [October 3, 2022, 8:13pm UTC](https://discuss.elastic.co/t/elastic-siem-cloud-data-storage-location-canadian-data-residency/315712 "2022-10-03T20:13:37Z")
I need to know if Elastic meets Canadian Data Residency requirements. Meaning the solution for a canadian company would store its data in canada. Thank you! --- ## [Endpoint security configuration](https://discuss.elastic.co/t/endpoint-security-configuration/315486)
**Author:** [@ttyser](https://discuss.elastic.co/u/ttyser)\ **Replies:** 7\ **Last updated:** [October 3, 2022, 9:13am UTC](https://discuss.elastic.co/t/endpoint-security-configuration/315486 "2022-10-03T09:13:38Z")
Hello all, I have an agent deployed via fleet on red hat server and I want to use the endpoint security there. I did add the endpoint security integration under the policy the red hat agent is bound to. Now it seems like… --- ## [Create rules error](https://discuss.elastic.co/t/create-rules-error/314993)
**Author:** [@zhixiang\_hao](https://discuss.elastic.co/u/zhixiang_hao)\ **Replies:** 1\ **Last updated:** [September 29, 2022, 8:24pm UTC](https://discuss.elastic.co/t/create-rules-error/314993 "2022-09-29T20:24:44Z")
There is no problem in the test on the platform, and the alarm can be reported normally, but an error is reported when I create a rule --- ## [Alert rule for windows commands like ping](https://discuss.elastic.co/t/alert-rule-for-windows-commands-like-ping/315441)
**Author:** [@Kiko1](https://discuss.elastic.co/u/Kiko1)\ **Replies:** 0\ **Last updated:** [September 29, 2022, 9:42am UTC](https://discuss.elastic.co/t/alert-rule-for-windows-commands-like-ping/315441 "2022-09-29T09:42:57Z")
Hi! I created a rule to detect the ping command but it doesn't work for me. Rule: process.name:"PING.exe" and process.state:"running" The same rule with for example the powershell.exe works. Thx --- ## [Alert : kibana.alert.rule.name: "Remote Execution via File Shares"](https://discuss.elastic.co/t/alert-kibana-alert-rule-name-remote-execution-via-file-shares/315378)
**Author:** [@Viral-Technology](https://discuss.elastic.co/u/Viral-Technology)\ **Replies:** 0\ **Last updated:** [September 28, 2022, 2:16pm UTC](https://discuss.elastic.co/t/alert-kibana-alert-rule-name-remote-execution-via-file-shares/315378 "2022-09-28T14:16:48Z")
Hello All, We are very new to the Elastic Stack, We had an alert show up this morning for " Remote Execution via File Shares" However, I can not find any corresponding data to go with it. is it normal that this alert do… --- ## [Errors in Kibana: plugins.securitySolution.endpoint:metadata-check-transforms-task:0.0.1](https://discuss.elastic.co/t/errors-in-kibana-plugins-securitysolution-endpoint0-0-1/314134)
**Author:** [@kurdit](https://discuss.elastic.co/u/kurdit)\ **Replies:** 1\ **Last updated:** [September 26, 2022, 2:02pm UTC](https://discuss.elastic.co/t/errors-in-kibana-plugins-securitysolution-endpoint0-0-1/314134 "2022-09-26T14:02:46Z")
hi all! in kibana.log I see a lot of errors like \[2022-09-07T03:58:32.117+03:00\]\[WARN \]\[plugins.securitySolution.endpoint:metadata-check-transforms-task:0.0.1\] transform endpoint.metadata\_current-default-8.3.0 has fail… [Previous page](https://discuss.elastic.co/c/security/83.md?page=27) [Next page](https://discuss.elastic.co/c/security/83.md?page=29)