# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=29 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 30 --- ## [Alert when an event is not followed by another](https://discuss.elastic.co/t/alert-when-an-event-is-not-followed-by-another/314527)
**Author:** [@bricevalenza](https://discuss.elastic.co/u/bricevalenza)\ **Replies:** 6\ **Last updated:** [September 26, 2022, 8:00am UTC](https://discuss.elastic.co/t/alert-when-an-event-is-not-followed-by-another/314527 "2022-09-26T08:00:05Z")
Hello, I am looking for a solution to create an alert when the following happens: An event with the field winlog.event\_id: "4202" occurs. 5 minutes later, no event with the field winlog.event\_id: "4204" was detected. … --- ## [EQL: Get only one match (no overlap)](https://discuss.elastic.co/t/eql-get-only-one-match-no-overlap/315014)
**Author:** [@miela](https://discuss.elastic.co/u/miela)\ **Replies:** 0\ **Last updated:** [September 23, 2022, 12:34pm UTC](https://discuss.elastic.co/t/eql-get-only-one-match-no-overlap/315014 "2022-09-23T12:34:10Z")
Hi Let's consider that we have the following event sequence: A, A, A, C, A, B, B, B now I want a EQL query that matches exactly one A, B sequence, the A, B selection can be arbitrary, i.e., the following are, for inst… --- ## [Elastic Security - "merge" logs after hostname rename](https://discuss.elastic.co/t/elastic-security-merge-logs-after-hostname-rename/315005)
**Author:** [@Marc\_Spect](https://discuss.elastic.co/u/Marc_Spect)\ **Replies:** 0\ **Last updated:** [September 23, 2022, 9:32am UTC](https://discuss.elastic.co/t/elastic-security-merge-logs-after-hostname-rename/315005 "2022-09-23T09:32:29Z")
Hello, I use Fleet and Security on a Elasticsearch and Kibana dashboard. I received logs for a period of time from a hostname "X", for which I would like to change its name now to "Y". Doing this would generate two host… --- ## [EQL rules are wrong, God help me](https://discuss.elastic.co/t/eql-rules-are-wrong-god-help-me/314606)
**Author:** [@zhixiang\_hao](https://discuss.elastic.co/u/zhixiang_hao)\ **Replies:** 6\ **Last updated:** [September 22, 2022, 2:19am UTC](https://discuss.elastic.co/t/eql-rules-are-wrong-god-help-me/314606 "2022-09-22T02:19:11Z")
sequence by process.entity\_id with maxspan = 30s \[process where event.type in ("start", "process\_started") and process.name:("powershell.exe", "pwsh.exe","cmd.exe","wmic.exe","excel.exe") and process.command\_line:("H… --- ## [Not able to edit rules](https://discuss.elastic.co/t/not-able-to-edit-rules/314643)
**Author:** [@UweW](https://discuss.elastic.co/u/UweW)\ **Replies:** 11\ **Last updated:** [September 20, 2022, 5:01pm UTC](https://discuss.elastic.co/t/not-able-to-edit-rules/314643 "2022-09-20T17:01:39Z")
Hi, after updating from 8.2.3 to 8.4 it's no longer possible to edit the existing rules. Every time "Object type "siem.queryRule" is not registered." is shown. Hope somebody has an idea how to fix. another error occu… --- ## [Elastic Endpoint cannot send alerts to kibana](https://discuss.elastic.co/t/elastic-endpoint-cannot-send-alerts-to-kibana/314644)
**Author:** [@Fatima](https://discuss.elastic.co/u/Fatima)\ **Replies:** 1\ **Last updated:** [September 20, 2022, 3:24pm UTC](https://discuss.elastic.co/t/elastic-endpoint-cannot-send-alerts-to-kibana/314644 "2022-09-20T15:24:39Z")
Hi people, I have configured the beats and EDR and I am getting all the events from the different hosts. I have enabled all the preset security rules but I am not getting any alerts. This is the message I get when doi… --- ## [Training Recomandtion](https://discuss.elastic.co/t/training-recomandtion/314406)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 1\ **Last updated:** [September 19, 2022, 5:25pm UTC](https://discuss.elastic.co/t/training-recomandtion/314406 "2022-09-19T17:25:00Z")
Hi there, I am an Elastic admin for observability. I would to start with the security (SIEM) topic as well. I am a newbie in this regard. Which of this trainings would you suggest to attend at first: Onsite & Online Tra… --- ## [Osquery Manager Feedback - OSQuery manager API needed for automatically downloading Elastic packs](https://discuss.elastic.co/t/osquery-manager-feedback-osquery-manager-api-needed-for-automatically-downloading-elastic-packs/314536)
**Author:** [@joedissmeyer](https://discuss.elastic.co/u/joedissmeyer)\ **Replies:** 2\ **Last updated:** [September 16, 2022, 7:36pm UTC](https://discuss.elastic.co/t/osquery-manager-feedback-osquery-manager-api-needed-for-automatically-downloading-elastic-packs/314536 "2022-09-16T19:36:51Z")
Hello! Is there a Kibana API I can use to automatically download and install the Elastic created OSquery manager packs? There are several APIs available documented here, Osquery manager API | Kibana Guide \[8.4\] | Elasti… --- ## [No exception lists found](https://discuss.elastic.co/t/no-exception-lists-found/312089)
**Author:** [@radovan](https://discuss.elastic.co/u/radovan)\ **Replies:** 16\ **Last updated:** [September 14, 2022, 8:48am UTC](https://discuss.elastic.co/t/no-exception-lists-found/312089 "2022-09-14T08:48:25Z")
Hi, in our default space I get a message saying "No exception lists found" and "We weren't able to find any exception lists." when I get into Exceptions in Security app even tho there are some exceptions (you can even s… --- ## [Threat detection EQL error](https://discuss.elastic.co/t/threat-detection-eql-error/314250)
**Author:** [@zhixiang\_hao](https://discuss.elastic.co/u/zhixiang_hao)\ **Replies:** 2\ **Last updated:** [September 14, 2022, 1:19am UTC](https://discuss.elastic.co/t/threat-detection-eql-error/314250 "2022-09-14T01:19:33Z")
Does anyone know what's causing it? --- ## [How to configure fleet server and enroll agents?](https://discuss.elastic.co/t/how-to-configure-fleet-server-and-enroll-agents/314314)
**Author:** [@Kosala\_Randika\_Paran](https://discuss.elastic.co/u/Kosala_Randika_Paran)\ **Replies:** 1\ **Last updated:** [September 13, 2022, 5:20pm UTC](https://discuss.elastic.co/t/how-to-configure-fleet-server-and-enroll-agents/314314 "2022-09-13T17:20:35Z")
Hi, I have an ELK stack which newly installed and need to configure the fleet server from scratch. --- ## [WIFI NIC Blocked by Elastic Agent](https://discuss.elastic.co/t/wifi-nic-blocked-by-elastic-agent/314030)
**Author:** [@xqaiviwjxzw](https://discuss.elastic.co/u/xqaiviwjxzw)\ **Replies:** 2\ **Last updated:** [September 13, 2022, 2:29am UTC](https://discuss.elastic.co/t/wifi-nic-blocked-by-elastic-agent/314030 "2022-09-13T02:29:01Z")
I have installed elastic agent on my windoes 10, but the wifi NIC is not working and I can't connect to wifi, but I uninstalled elastic agent and the wifi NIC is working and the wifi is working, what is the reason for th… --- ## [Crete alerts for disabled accounts](https://discuss.elastic.co/t/crete-alerts-for-disabled-accounts/312833)
**Author:** [@ajoshi37](https://discuss.elastic.co/u/ajoshi37)\ **Replies:** 14\ **Last updated:** [September 9, 2022, 9:03pm UTC](https://discuss.elastic.co/t/crete-alerts-for-disabled-accounts/312833 "2022-09-09T21:03:47Z")
Hi, I'm trying to create alerts for the Disabled account for Azure SSO but not able to find the context to that. Disabled account checks for event.code : 4725 Failed account checks for event.code : "4625" The logs do … --- ## [Elastic Security field values in connector getting duplicated](https://discuss.elastic.co/t/elastic-security-field-values-in-connector-getting-duplicated/313725)
**Author:** [@RaonyO](https://discuss.elastic.co/u/RaonyO)\ **Replies:** 2\ **Last updated:** [September 9, 2022, 12:30am UTC](https://discuss.elastic.co/t/elastic-security-field-values-in-connector-getting-duplicated/313725 "2022-09-09T00:30:38Z")
hello everyone, I'm trying to create a rule in elastic security via query in a specific index, and the rule detects it normally, but in the action part the events are going with duplicate fields. for example: "result": … --- ## [Elastic Rule Connector sends a String instead of JSON to the Webhook](https://discuss.elastic.co/t/elastic-rule-connector-sends-a-string-instead-of-json-to-the-webhook/313833)
**Author:** [@yzaritskyi](https://discuss.elastic.co/u/yzaritskyi)\ **Replies:** 5\ **Last updated:** [September 8, 2022, 7:18pm UTC](https://discuss.elastic.co/t/elastic-rule-connector-sends-a-string-instead-of-json-to-the-webhook/313833 "2022-09-08T19:18:13Z")
Hey there! First of all, I'd like to describe my situation. I have an Elastic Rule, that successfully creates the Alerts in the Elastic Security. Now I have configured a connector, that allows me to send those Alerts to… --- ## [Rule That Alerts When Logins Are Past a Certain Time](https://discuss.elastic.co/t/rule-that-alerts-when-logins-are-past-a-certain-time/311887)
**Author:** [@Jared9922](https://discuss.elastic.co/u/Jared9922)\ **Replies:** 1\ **Last updated:** [September 7, 2022, 7:45pm UTC](https://discuss.elastic.co/t/rule-that-alerts-when-logins-are-past-a-certain-time/311887 "2022-09-07T19:45:11Z")
I am trying to write a rule in Kibana that alerts when somebody logs in anytime after 7 PM and before 7 AM. I am trying to do this with a "Custom query" because this seems like the easiest approach. I have elastic agent … --- ## [Writing rules in KQL from a created index pattern](https://discuss.elastic.co/t/writing-rules-in-kql-from-a-created-index-pattern/312517)
**Author:** [@Didi\_Lilou](https://discuss.elastic.co/u/Didi_Lilou)\ **Replies:** 1\ **Last updated:** [September 7, 2022, 7:35pm UTC](https://discuss.elastic.co/t/writing-rules-in-kql-from-a-created-index-pattern/312517 "2022-09-07T19:35:24Z")
\#elastic-stack:logstash. Hello. I created an index pattern coming from snort in json format. I used logstash to create it But now i would like to write rules (xpack is activated) in kql coming from my snort index patt… --- ## [Using misp detection](https://discuss.elastic.co/t/using-misp-detection/312830)
**Author:** [@VitorBarroso](https://discuss.elastic.co/u/VitorBarroso)\ **Replies:** 1\ **Last updated:** [September 7, 2022, 7:29pm UTC](https://discuss.elastic.co/t/using-misp-detection/312830 "2022-09-07T19:29:02Z")
It's possible to use misp on endpoint security? What i need to do is, when i have a detect/prevent event, i need to say is which category of malware is. If this is not possible with misp, any other solution of this? --- ## [Detect Rules](https://discuss.elastic.co/t/detect-rules/312889)
**Author:** [@VitorBarroso](https://discuss.elastic.co/u/VitorBarroso)\ **Replies:** 1\ **Last updated:** [September 7, 2022, 6:36pm UTC](https://discuss.elastic.co/t/detect-rules/312889 "2022-09-07T18:36:47Z")
How i "connect" my detect rules with my events on External alert trend? My detect rules are those i load from the system. --- ## [Detect rules](https://discuss.elastic.co/t/detect-rules/312893)
**Author:** [@VitorBarroso](https://discuss.elastic.co/u/VitorBarroso)\ **Replies:** 1\ **Last updated:** [September 7, 2022, 6:30pm UTC](https://discuss.elastic.co/t/detect-rules/312893 "2022-09-07T18:30:01Z")
I need the elastic premium to use the Security\>Detect\>Alerts? If not, how i connect my external events to Security\>Detect\>Alerts? --- ## [CSPM for AWS](https://discuss.elastic.co/t/cspm-for-aws/313715)
**Author:** [@keiransteele](https://discuss.elastic.co/u/keiransteele)\ **Replies:** 1\ **Last updated:** [September 7, 2022, 6:05pm UTC](https://discuss.elastic.co/t/cspm-for-aws/313715 "2022-09-07T18:05:08Z")
Are there plans to have CSPM for AWS rather than just a misleading name and only Kubernetes? --- ## [INSTALL ELASTIC ENDPOINT](https://discuss.elastic.co/t/install-elastic-endpoint/313466)
**Author:** [@brouyao](https://discuss.elastic.co/u/brouyao)\ **Replies:** 2\ **Last updated:** [September 6, 2022, 7:50am UTC](https://discuss.elastic.co/t/install-elastic-endpoint/313466 "2022-09-06T07:50:09Z")
hi , how to install elastic endpoint on windows and linux. thanks you --- ## [SIEM case connector](https://discuss.elastic.co/t/siem-case-connector/312031)
**Author:** [@dlazure](https://discuss.elastic.co/u/dlazure)\ **Replies:** 2\ **Last updated:** [August 31, 2022, 11:19am UTC](https://discuss.elastic.co/t/siem-case-connector/312031 "2022-08-31T11:19:36Z")
Hi, Is there a way to connect the SIEM cases to TheHive ? Thank you, --- ## [EQL - Rule creation](https://discuss.elastic.co/t/eql-rule-creation/311732)
**Author:** [@Rahulvanadavsi](https://discuss.elastic.co/u/Rahulvanadavsi)\ **Replies:** 1\ **Last updated:** [August 31, 2022, 9:10am UTC](https://discuss.elastic.co/t/eql-rule-creation/311732 "2022-08-31T09:10:35Z")
Hi, We would like to create a use case for password spraying attack and Impossible travel activity in our environment. Password Spraying Attack - Attacker tying to bruteforce using default passwords for multiple accou… --- ## [Alert is not populating the right fields](https://discuss.elastic.co/t/alert-is-not-populating-the-right-fields/312663)
**Author:** [@aids123](https://discuss.elastic.co/u/aids123)\ **Replies:** 1\ **Last updated:** [August 31, 2022, 9:07am UTC](https://discuss.elastic.co/t/alert-is-not-populating-the-right-fields/312663 "2022-08-31T09:07:55Z")
I am trying to create an alert containing the fields populated(host.name,user.name,file.name,process.name), however when the rule trigger the alert it seems that these are not populated. I was advised that it is because … --- ## [Detect Rules](https://discuss.elastic.co/t/detect-rules/313182)
**Author:** [@VitorBarroso](https://discuss.elastic.co/u/VitorBarroso)\ **Replies:** 1\ **Last updated:** [August 31, 2022, 8:59am UTC](https://discuss.elastic.co/t/detect-rules/313182 "2022-08-31T08:59:56Z")
Can I detect a acess to website through endpoint security? Because i want to know if a host acess a certain website and "shot" a alert. --- ## [How to get context Alert Data in SUBJECT of Security Alert SIEM](https://discuss.elastic.co/t/how-to-get-context-alert-data-in-subject-of-security-alert-siem/312802)
**Author:** [@Rohit\_Kumbhar](https://discuss.elastic.co/u/Rohit_Kumbhar)\ **Replies:** 2\ **Last updated:** [August 30, 2022, 12:21pm UTC](https://discuss.elastic.co/t/how-to-get-context-alert-data-in-subject-of-security-alert-siem/312802 "2022-08-30T12:21:27Z")
Hi, I Have a Security Alert where I have to get data\_stream.namespace and host.name in SUBJECT of Alert Can someone please guide me through it? I have tried below but got blank in output mail subject Subject : AlertN… --- ## [False Positive Report](https://discuss.elastic.co/t/false-positive-report/311191)
**Author:** [@ChristianR](https://discuss.elastic.co/u/ChristianR)\ **Replies:** 6\ **Last updated:** [August 30, 2022, 7:06am UTC](https://discuss.elastic.co/t/false-positive-report/311191 "2022-08-30T07:06:42Z")
Hi, we followed your advice and forwarded a false positive report to fp\_reports@elastic.co but have not received any response. Pls advise: Filename: mavwin\_8\_35\_0\_9.exe Hash (SHA256): 3987CB0CCDD1FABB879AF8E59EB847E104… --- ## [Prebuilt Security Detection Rules in policy or just install assets?](https://discuss.elastic.co/t/prebuilt-security-detection-rules-in-policy-or-just-install-assets/312959)
**Author:** [@ARDiver86](https://discuss.elastic.co/u/ARDiver86)\ **Replies:** 2\ **Last updated:** [August 29, 2022, 7:00pm UTC](https://discuss.elastic.co/t/prebuilt-security-detection-rules-in-policy-or-just-install-assets/312959 "2022-08-29T19:00:52Z")
I do not see it documented anywhere but my assumption is the "Prebuilt Security Detection Rules" integration is there so we can install the assets in Elasticsearch and not actually add this integration to policies? Can … --- ## [Ask question security](https://discuss.elastic.co/t/ask-question-security/313068)
**Author:** [@zhixiang\_hao](https://discuss.elastic.co/u/zhixiang_hao)\ **Replies:** 0\ **Last updated:** [August 27, 2022, 3:08pm UTC](https://discuss.elastic.co/t/ask-question-security/313068 "2022-08-27T15:08:18Z")
When I used it before, there were rules in it, and now I switched to the white version, why are there no rules? [Previous page](https://discuss.elastic.co/c/security/83.md?page=28) [Next page](https://discuss.elastic.co/c/security/83.md?page=30)