# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=3 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 4 --- ## [Error calling connector: Status code: undefined. Message: Unexpected API Error: ECONNABORTED - timeout of 60000ms exceeded](https://discuss.elastic.co/t/error-calling-connector-status-code-undefined-message-unexpected-api-error-econnaborted-timeout-of-60000ms-exceeded/383621)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 3\ **Last updated:** [December 5, 2025, 7:47pm UTC](https://discuss.elastic.co/t/error-calling-connector-status-code-undefined-message-unexpected-api-error-econnaborted-timeout-of-60000ms-exceeded/383621 "2025-12-05T19:47:33Z")
Hello, I am receiving this error message. Do you have any idea how I can diagnose it? I have already deleted the connector and created it again, but the problem persists. Error calling connector: Status code: undefine… --- ## [Agent Spoofing alerts due to mismatched agent id's since 9.2.1 update](https://discuss.elastic.co/t/agent-spoofing-alerts-due-to-mismatched-agent-ids-since-9-2-1-update/383420)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 4\ **Last updated:** [November 20, 2025, 10:25pm UTC](https://discuss.elastic.co/t/agent-spoofing-alerts-due-to-mismatched-agent-ids-since-9-2-1-update/383420 "2025-11-20T22:25:19Z")
Since I updated this afternoon to 9.2.1 this alert triggers continuously for all my 3 agents. Grtz --- ## [Block USB(s) by default with Elastic Agent?](https://discuss.elastic.co/t/block-usb-s-by-default-with-elastic-agent/382809)
**Author:** [@BlueGreenRed1](https://discuss.elastic.co/u/BlueGreenRed1)\ **Replies:** 9\ **Last updated:** [November 18, 2025, 7:50pm UTC](https://discuss.elastic.co/t/block-usb-s-by-default-with-elastic-agent/382809 "2025-11-18T19:50:56Z")
Hello, I am posting to find out if this feature is still on the Elastic Team’s roadmap? I found previous posts from 2022 and 2023 requesting this feature. In short, it would be a nice feature if the Elastic Agent could… --- ## [Endpoint Agent Healthy changes to unhealthy and has not logs](https://discuss.elastic.co/t/endpoint-agent-healthy-changes-to-unhealthy-and-has-not-logs/383340)
**Author:** [@Jeffrey\_Barda](https://discuss.elastic.co/u/Jeffrey_Barda)\ **Replies:** 4\ **Last updated:** [November 12, 2025, 3:31pm UTC](https://discuss.elastic.co/t/endpoint-agent-healthy-changes-to-unhealthy-and-has-not-logs/383340 "2025-11-12T15:31:12Z")
My Endpoint Health Status changed to unhealthy on my Windows Endpoint a few minutes after it had shown healthy. I have disabled my Windows firewall and checked my policy configuration. What could be the problem? --- ## [Custom Elastic Defend endpoint protection rules？](https://discuss.elastic.co/t/custom-elastic-defend-endpoint-protection-rules/383149)
**Author:** [@GeShanDaKongQi233](https://discuss.elastic.co/u/GeShanDaKongQi233)\ **Replies:** 3\ **Last updated:** [November 6, 2025, 1:57pm UTC](https://discuss.elastic.co/t/custom-elastic-defend-endpoint-protection-rules/383149 "2025-11-06T13:57:40Z")
The YARA rules and behavioral rules of Elastic Defend are shared with the community, allowing blue teams and defenders to learn from them and improve their defenses. However, we have also observed that many red team memb… --- ## [Elastic Defend Windows Defender question](https://discuss.elastic.co/t/elastic-defend-windows-defender-question/383157)
**Author:** [@YousefNein](https://discuss.elastic.co/u/YousefNein)\ **Replies:** 9\ **Last updated:** [November 3, 2025, 1:44pm UTC](https://discuss.elastic.co/t/elastic-defend-windows-defender-question/383157 "2025-11-03T13:44:45Z")
From the attached pic, I don’t understand this warning restriction. I also need some clarification with: Enable to register Elastic as an official Antivirus solution for Windows OS. This will also disable Windows Defe… --- ## [Oracle DB integration with Unified logs](https://discuss.elastic.co/t/oracle-db-integration-with-unified-logs/383160)
**Author:** [@Alaeddine\_khadraoui](https://discuss.elastic.co/u/Alaeddine_khadraoui)\ **Replies:** 1\ **Last updated:** [November 2, 2025, 1:49pm UTC](https://discuss.elastic.co/t/oracle-db-integration-with-unified-logs/383160 "2025-11-02T13:49:48Z")
We Have Oracle DB configured with Unified Auditing, under unified auditing all DB audit records stored in a single file, we dont have \*.aud files generated which is used and expected by the Oracle Integration What the o… --- ## [Parsing issue with oracle db integration](https://discuss.elastic.co/t/parsing-issue-with-oracle-db-integration/382511)
**Author:** [@Alaeddine\_khadraoui](https://discuss.elastic.co/u/Alaeddine_khadraoui)\ **Replies:** 5\ **Last updated:** [November 2, 2025, 8:05am UTC](https://discuss.elastic.co/t/parsing-issue-with-oracle-db-integration/382511 "2025-11-02T08:05:46Z")
Hi all, I want to monitor Oracle db audit logs, the elastic agent installed on the host, i have added the Oracle db integration v1.31.0. and enabled it to receive the audit logs ,added the path to audit log file, the da… --- ## [Windows Event 7009 - A timeout was reached (30000 milliseconds) while waiting for the Elastic Agent service to connect](https://discuss.elastic.co/t/windows-event-7009-a-timeout-was-reached-30000-milliseconds-while-waiting-for-the-elastic-agent-service-to-connect/383052)
**Author:** [@bgreen99](https://discuss.elastic.co/u/bgreen99)\ **Replies:** 4\ **Last updated:** [October 31, 2025, 12:55pm UTC](https://discuss.elastic.co/t/windows-event-7009-a-timeout-was-reached-30000-milliseconds-while-waiting-for-the-elastic-agent-service-to-connect/383052 "2025-10-31T12:55:04Z")
We are often getting a windows event code 7009 post reboot regarding elastic agent service not starting indicating: A timeout was reached (30000 milliseconds) while waiting for the Elastic Agent service to connect. This… --- ## [Detection rules manual run: cannot be scheduled earlier than 90 days ago](https://discuss.elastic.co/t/detection-rules-manual-run-cannot-be-scheduled-earlier-than-90-days-ago/383033)
**Author:** [@niklaskurvinen](https://discuss.elastic.co/u/niklaskurvinen)\ **Replies:** 2\ **Last updated:** [October 31, 2025, 4:33am UTC](https://discuss.elastic.co/t/detection-rules-manual-run-cannot-be-scheduled-earlier-than-90-days-ago/383033 "2025-10-31T04:33:00Z")
Hi, Just came across the “Manual rule run cannot be scheduled earlier than 90 days ago” message for the first time. Is there a reason for this limitation and more importantly; can I override it? Tried to find any kind o… --- ## [What Can I Do with Elastic SIEM Free Tier? (Capabilities and Limitations)](https://discuss.elastic.co/t/what-can-i-do-with-elastic-siem-free-tier-capabilities-and-limitations/383103)
**Author:** [@cyberfury](https://discuss.elastic.co/u/cyberfury)\ **Replies:** 1\ **Last updated:** [October 30, 2025, 2:01pm UTC](https://discuss.elastic.co/t/what-can-i-do-with-elastic-siem-free-tier-capabilities-and-limitations/383103 "2025-10-30T14:01:42Z")
Hi everyone, I’ve successfully installed on premises Elasticsearch, Logstash, Kibana, and Elastic Agent/Fleet Server on my Ubuntu server. I’m now exploring the SIEM features in the Elastic Stack free tier, but I’m a bit… --- ## [Rule exception with value list](https://discuss.elastic.co/t/rule-exception-with-value-list/382698)
**Author:** [@Marek\_Galbavy](https://discuss.elastic.co/u/Marek_Galbavy)\ **Replies:** 2\ **Last updated:** [October 29, 2025, 3:52pm UTC](https://discuss.elastic.co/t/rule-exception-with-value-list/382698 "2025-10-29T15:52:34Z")
Hi everyone, I’m not sure if this is a bug or expected behavior, but when I try to create a rule exception and use a value list on one field, I can’t use the regular “is” operator on another field — it only lets me choos… --- ## [Fleet server, policy, and integrations for Linux terminal](https://discuss.elastic.co/t/fleet-server-policy-and-integrations-for-linux-terminal/382981)
**Author:** [@Eren\_Cil](https://discuss.elastic.co/u/Eren_Cil)\ **Replies:** 6\ **Last updated:** [October 28, 2025, 1:20pm UTC](https://discuss.elastic.co/t/fleet-server-policy-and-integrations-for-linux-terminal/382981 "2025-10-28T13:20:54Z")
Hello everyone. I want to watch my Linux terminal with simple integrations and custom-defined rules. Right now, I’ve tried system, auditd, or both at the same time. But there is always something wrong with the fleet serv… --- ## [Integration of Kaspersky AV with the elastic SIEM](https://discuss.elastic.co/t/integration-of-kaspersky-av-with-the-elastic-siem/358924)
**Author:** [@Amanda\_Riverol\_Quesa](https://discuss.elastic.co/u/Amanda_Riverol_Quesa)\ **Replies:** 4\ **Last updated:** [October 26, 2025, 8:28am UTC](https://discuss.elastic.co/t/integration-of-kaspersky-av-with-the-elastic-siem/358924 "2025-10-26T08:28:53Z")
I would like to send the Kaspersky antivirus events to the elastic stack but I can't find an integration that allows me to do that. Is there a way to do it? --- ## [Threat Intel Module integrations questions](https://discuss.elastic.co/t/threat-intel-module-integrations-questions/381256)
**Author:** [@mouse51180](https://discuss.elastic.co/u/mouse51180)\ **Replies:** 1\ **Last updated:** [October 22, 2025, 7:25pm UTC](https://discuss.elastic.co/t/threat-intel-module-integrations-questions/381256 "2025-10-22T19:25:49Z")
Please bare with me as I am completely new to Elastic and trying to understand how to use it properly. I also am at the beginning of really learning cyber security. My understanding on these modules is that Filebeat wil… --- ## [Server objects and network objects?](https://discuss.elastic.co/t/server-objects-and-network-objects/381760)
**Author:** [@kippi](https://discuss.elastic.co/u/kippi)\ **Replies:** 1\ **Last updated:** [October 22, 2025, 7:21pm UTC](https://discuss.elastic.co/t/server-objects-and-network-objects/381760 "2025-10-22T19:21:07Z")
Hi I’m a rookie student try to understand if something is possible in Elasticsearch… In Qradar you can define server objects and network objects, for example internal servers, network zones or IP ranges and then use the… --- ## [Elastic Defend Integration 8.18.1 not detecting/preventing at all?](https://discuss.elastic.co/t/elastic-defend-integration-8-18-1-not-detecting-preventing-at-all/382817)
**Author:** [@boredchilada](https://discuss.elastic.co/u/boredchilada)\ **Replies:** 3\ **Last updated:** [October 21, 2025, 5:44pm UTC](https://discuss.elastic.co/t/elastic-defend-integration-8-18-1-not-detecting-preventing-at-all/382817 "2025-10-21T17:44:55Z")
I just noticed that for some reason one of my policies was not detecting or preventing anything. I reinstalled the agent which applied the default endpoint initial policy which still had the 8.17.0 elastic defend integra… --- ## [Authentication of \[elastic\] was terminated by realm \[reserved\] - failed to authenticate user \[elastic\]](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved-failed-to-authenticate-user-elastic/382752)
**Author:** [@onitnas](https://discuss.elastic.co/u/onitnas)\ **Replies:** 6\ **Last updated:** [October 16, 2025, 8:46am UTC](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved-failed-to-authenticate-user-elastic/382752 "2025-10-16T08:46:58Z")
Hi everyone, I’m following this guide: Getting Started with the Elastic Stack and Docker Compose and I’m using Elastic Stack version 8.19.4. I have a setup container in my Docker Compose configuration, but it gets stuc… --- ## [Orphaned agent is healthy in 9.0.1](https://discuss.elastic.co/t/orphaned-agent-is-healthy-in-9-0-1/378424)
**Author:** [@syk](https://discuss.elastic.co/u/syk)\ **Replies:** 11\ **Last updated:** [October 10, 2025, 7:02am UTC](https://discuss.elastic.co/t/orphaned-agent-is-healthy-in-9-0-1/378424 "2025-10-10T07:02:44Z")
Self hosted installation of ELK 9.0.1 with ~30 agents running: On a Windows Server 2022 we deployed an elastic-agent which reports that everything is fine (elastic-agent status: fleet connected and agent healthy). In K… --- ## [Podman path starts with . causes heaps of alerts](https://discuss.elastic.co/t/podman-path-starts-with-causes-heaps-of-alerts/382535)
**Author:** [@michael-a](https://discuss.elastic.co/u/michael-a)\ **Replies:** 2\ **Last updated:** [October 10, 2025, 5:47am UTC](https://discuss.elastic.co/t/podman-path-starts-with-causes-heaps-of-alerts/382535 "2025-10-10T05:47:07Z")
We’ve received large numbers of alerts from Linux endpoints where standard rule exeptions don’t work due to the fact that the logged process.executable path starts with a . rather than /, which affect multiple rules. Loo… --- ## [Cannot modify rule exceptions post upgrade to 9.1.4](https://discuss.elastic.co/t/cannot-modify-rule-exceptions-post-upgrade-to-9-1-4/382216)
**Author:** [@michael-a](https://discuss.elastic.co/u/michael-a)\ **Replies:** 2\ **Last updated:** [October 8, 2025, 10:25am UTC](https://discuss.elastic.co/t/cannot-modify-rule-exceptions-post-upgrade-to-9-1-4/382216 "2025-10-08T10:25:25Z")
Since upgrading from 8.17.10 via 18.19.3 to 9.1.4, we’ve encountered an issue with rule exceptions for users without superuser privileges in that it’s possible to create rule exceptions but once created, it takes superus… --- ## [FIlter in the rule interface](https://discuss.elastic.co/t/filter-in-the-rule-interface/382408)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 2\ **Last updated:** [October 4, 2025, 11:49am UTC](https://discuss.elastic.co/t/filter-in-the-rule-interface/382408 "2025-10-04T11:49:42Z")
Hello, So is there a way to search or filter on severity of the rule? Grtz --- ## [TypeError: t is not a function](https://discuss.elastic.co/t/typeerror-t-is-not-a-function/382294)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 1\ **Last updated:** [October 3, 2025, 8:50pm UTC](https://discuss.elastic.co/t/typeerror-t-is-not-a-function/382294 "2025-10-03T20:50:10Z")
When I receive an email alert, it contains a hyperlink that is supposed to take me to the details of the email alert, but when I open the message, I get this error message. Error details --- ## [Elastic Security Threat Match rule](https://discuss.elastic.co/t/elastic-security-threat-match-rule/382281)
**Author:** [@lduvnjak](https://discuss.elastic.co/u/lduvnjak)\ **Replies:** 5\ **Last updated:** [October 1, 2025, 9:30am UTC](https://discuss.elastic.co/t/elastic-security-threat-match-rule/382281 "2025-10-01T09:30:09Z")
I have a couple of questions about how threat match rules work in Elasticsearch, which I feel the documentation does not cover very well. The question is about the Custom query parameter, the frequency, and the addition… --- ## [How to add a webhook connector with its body to all existing Elastic detection rules automatically?](https://discuss.elastic.co/t/how-to-add-a-webhook-connector-with-its-body-to-all-existing-elastic-detection-rules-automatically/382212)
**Author:** [@Omar\_Medhat](https://discuss.elastic.co/u/Omar_Medhat)\ **Replies:** 1\ **Last updated:** [September 30, 2025, 4:38pm UTC](https://discuss.elastic.co/t/how-to-add-a-webhook-connector-with-its-body-to-all-existing-elastic-detection-rules-automatically/382212 "2025-09-30T16:38:39Z")
I created a webhook connector, and I want to add it to all of my installed detection rules without having to manually edit each rule’s actions section one by one. Is there a way to add it to all of them automatically? Es… --- ## [Using fields outside ECS for exceptions in rules](https://discuss.elastic.co/t/using-fields-outside-ecs-for-exceptions-in-rules/381522)
**Author:** [@Ruslan\_Hafizov](https://discuss.elastic.co/u/Ruslan_Hafizov)\ **Replies:** 4\ **Last updated:** [September 30, 2025, 1:57pm UTC](https://discuss.elastic.co/t/using-fields-outside-ecs-for-exceptions-in-rules/381522 "2025-09-30T13:57:46Z")
Good time of day. I have a rule that creates an alert and I need to add an exception to it. Within the request, describing this exception will be problematic, as it will inflate the size of the request. So I decided to u… --- ## [O365 Logs - Single failed log in attempt multiple logs generated](https://discuss.elastic.co/t/o365-logs-single-failed-log-in-attempt-multiple-logs-generated/382237)
**Author:** [@rey\_espinosa](https://discuss.elastic.co/u/rey_espinosa)\ **Replies:** 2\ **Last updated:** [September 29, 2025, 6:35am UTC](https://discuss.elastic.co/t/o365-logs-single-failed-log-in-attempt-multiple-logs-generated/382237 "2025-09-29T06:35:51Z")
Is it possible that a single failed log in attempt can generate multiple logs and the only difference it a millisecond on their timestamp that looks like automated attack ? --- ## [javax.net.ssl.SSLHandshakeException: Received fatal alert: bad\_certificate](https://discuss.elastic.co/t/javax-net-ssl-sslhandshakeexception-received-fatal-alert-bad-certificate/381314)
**Author:** [@gadde36256](https://discuss.elastic.co/u/gadde36256)\ **Replies:** 1\ **Last updated:** [September 29, 2025, 12:19pm UTC](https://discuss.elastic.co/t/javax-net-ssl-sslhandshakeexception-received-fatal-alert-bad-certificate/381314 "2025-09-29T12:19:53Z")
I was trying to access Cassandra data as input jdbc using ing-bank driver with mtls certs, I was always getting bad certificate error with below error on latest version of logstash 9.1.2. Same certs are working with pyt… --- ## [SCA and VM](https://discuss.elastic.co/t/sca-and-vm/382243)
**Author:** [@adis3421](https://discuss.elastic.co/u/adis3421)\ **Replies:** 0\ **Last updated:** [September 26, 2025, 7:43am UTC](https://discuss.elastic.co/t/sca-and-vm/382243 "2025-09-26T07:43:22Z")
Does the Elastic team have plans to implement vulnerability management and SCA for non-cloud systems? --- ## [How to include field data from multiple documents in \`Create a model response\` API request?](https://discuss.elastic.co/t/how-to-include-field-data-from-multiple-documents-in-create-a-model-response-api-request/382129)
**Author:** [@logalicious](https://discuss.elastic.co/u/logalicious)\ **Replies:** 1\ **Last updated:** [September 23, 2025, 6:51pm UTC](https://discuss.elastic.co/t/how-to-include-field-data-from-multiple-documents-in-create-a-model-response-api-request/382129 "2025-09-23T18:51:21Z")
I am trying to use the Create a model response API to create an AI assistant response that summarizes many alerts at once. When I include multiple messages that each contain field data from security alerts, the Security … [Previous page](https://discuss.elastic.co/c/security/83.md?page=2) [Next page](https://discuss.elastic.co/c/security/83.md?page=4)