# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=30 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 31 --- ## [Elastic Endpoint 8.3.3 on Windows Server 2019 constantly restarting service](https://discuss.elastic.co/t/elastic-endpoint-8-3-3-on-windows-server-2019-constantly-restarting-service/312694)
**Author:** [@adam\_zaklika](https://discuss.elastic.co/u/adam_zaklika)\ **Replies:** 2\ **Last updated:** [August 26, 2022, 11:50am UTC](https://discuss.elastic.co/t/elastic-endpoint-8-3-3-on-windows-server-2019-constantly-restarting-service/312694 "2022-08-26T11:50:08Z")
Hi all! It's my first post here so i would like to say hi everyone :slight\_smile: I'm testing elastic security on our environment. I have installed few Elastic Agents on Windows Server 2019 and it works like a charm. T… --- ## [Why filebeat pipelines disappoint or SIEM missing authentication patterns](https://discuss.elastic.co/t/why-filebeat-pipelines-disappoint-or-siem-missing-authentication-patterns/307308)
**Author:** [@Alexander\_A](https://discuss.elastic.co/u/Alexander_A)\ **Replies:** 12\ **Last updated:** [August 23, 2022, 9:34am UTC](https://discuss.elastic.co/t/why-filebeat-pipelines-disappoint-or-siem-missing-authentication-patterns/307308 "2022-08-23T09:34:21Z")
Filebeat has a lot of modules and I like it but I can see that its approach to log parsing is chaotic. Almost all tests I can find for testing ingest pipelines on github missing example of messages about successful or fa… --- ## [EndPoint Security](https://discuss.elastic.co/t/endpoint-security/312480)
**Author:** [@VitorBarroso](https://discuss.elastic.co/u/VitorBarroso)\ **Replies:** 3\ **Last updated:** [August 22, 2022, 7:21pm UTC](https://discuss.elastic.co/t/endpoint-security/312480 "2022-08-22T19:21:09Z")
When i run a "virus" called eicar on my windows user, the endpoint launching an alert(prevent or detect) but i don't receive the alert on my elasticsearc dashboard. Any solution for this problem? --- ## [How to filter my hosts?](https://discuss.elastic.co/t/how-to-filter-my-hosts/312491)
**Author:** [@yyie](https://discuss.elastic.co/u/yyie)\ **Replies:** 3\ **Last updated:** [August 19, 2022, 9:53pm UTC](https://discuss.elastic.co/t/how-to-filter-my-hosts/312491 "2022-08-19T21:53:31Z")
Hi, i'm new in ELK and I'm planning to add several hosts to my SIEM. I have several hosts distributed in several company locations and I want to be able to analyze each location separately. I tried to add tags to the ag… --- ## [How to send email alert to groups based on condition success using Kibana Rules](https://discuss.elastic.co/t/how-to-send-email-alert-to-groups-based-on-condition-success-using-kibana-rules/312198)
**Author:** [@bhavya](https://discuss.elastic.co/u/bhavya)\ **Replies:** 0\ **Last updated:** [August 16, 2022, 2:53pm UTC](https://discuss.elastic.co/t/how-to-send-email-alert-to-groups-based-on-condition-success-using-kibana-rules/312198 "2022-08-16T14:53:49Z")
I have created a rule using Kibana rules, by following the below steps: Created a new rule by selecting "Rule" under the "Security" section Then selected the rule type as "Event Correlation", wherein I added the index … --- ## [Elastic/Kibana integration with TheHive](https://discuss.elastic.co/t/elastic-kibana-integration-with-thehive/312454)
**Author:** [@Kara1990](https://discuss.elastic.co/u/Kara1990)\ **Replies:** 0\ **Last updated:** [August 19, 2022, 10:08am UTC](https://discuss.elastic.co/t/elastic-kibana-integration-with-thehive/312454 "2022-08-19T10:08:26Z")
Hi. Is there a guide somewhere how to take all the information from the alarm in kibana over to TheHive via webhook? What I'm looking for is when an alarm is triggered, then all data regarding the alarm must be transfe… --- ## [How to get all rules from Elasticsearch Security using curl API?](https://discuss.elastic.co/t/how-to-get-all-rules-from-elasticsearch-security-using-curl-api/311618)
**Author:** [@xynobob](https://discuss.elastic.co/u/xynobob)\ **Replies:** 3\ **Last updated:** [August 16, 2022, 8:54am UTC](https://discuss.elastic.co/t/how-to-get-all-rules-from-elasticsearch-security-using-curl-api/311618 "2022-08-16T08:54:38Z")
I have been trying to get all the rules (thousands of them) from my Elasticsearch Security using the curl API, however the only example and way shown on the website is able to obtain only one single rule at a time by run… --- ## [Elastic agent Unhealthy](https://discuss.elastic.co/t/elastic-agent-unhealthy/311426)
**Author:** [@MAPER](https://discuss.elastic.co/u/MAPER)\ **Replies:** 1\ **Last updated:** [August 12, 2022, 8:34pm UTC](https://discuss.elastic.co/t/elastic-agent-unhealthy/311426 "2022-08-12T20:34:48Z")
HI, I have my Elastic cluster , Kibana and Fleet up and running. Now I created New Agent-policy it has Endpoint and system integration. When I am Adding the agent client system the Agent installed successfully and Hea… --- ## [Elastic Siem external alerts](https://discuss.elastic.co/t/elastic-siem-external-alerts/310918)
**Author:** [@abr4xc](https://discuss.elastic.co/u/abr4xc)\ **Replies:** 4\ **Last updated:** [August 11, 2022, 7:58pm UTC](https://discuss.elastic.co/t/elastic-siem-external-alerts/310918 "2022-08-11T19:58:33Z")
I am trying to set up a new integration for an EDR that is not listed on the Kibana integrations yet, in order to set up the external alerts for that EDR i am adding the event.kind to alert but its not showing up in the … --- ## [Problem with Detections - Custom query rule](https://discuss.elastic.co/t/problem-with-detections-custom-query-rule/311543)
**Author:** [@Yuriy\_Tsarenko](https://discuss.elastic.co/u/Yuriy_Tsarenko)\ **Replies:** 9\ **Last updated:** [August 11, 2022, 12:24pm UTC](https://discuss.elastic.co/t/problem-with-detections-custom-query-rule/311543 "2022-08-11T12:24:47Z")
Good afternoon dear community. I turn to you with the following problem. The custom rule does not create security alerts, although it works without visible errors. Kibana Version: 8.3.1 Rule type: custom query. Rule … --- ## [Illegal\_argument\_exception](https://discuss.elastic.co/t/illegal-argument-exception/311847)
**Author:** [@Carlos\_Vinicius](https://discuss.elastic.co/u/Carlos_Vinicius)\ **Replies:** 2\ **Last updated:** [August 11, 2022, 11:59am UTC](https://discuss.elastic.co/t/illegal-argument-exception/311847 "2022-08-11T11:59:12Z")
Dears, good morning! I'm facing the error below, can someone shed some light on me? { "took": 461, "timed\_out": false, "\_shards": { "total": 39, "successful": 38, "skipped": 33, "failed": 1, "failures": \[ { … --- ## [Run detetion rules backwards](https://discuss.elastic.co/t/run-detetion-rules-backwards/311420)
**Author:** [@arturo.mj](https://discuss.elastic.co/u/arturo.mj)\ **Replies:** 4\ **Last updated:** [August 9, 2022, 12:54pm UTC](https://discuss.elastic.co/t/run-detetion-rules-backwards/311420 "2022-08-09T12:54:14Z")
Hi there, This is the situation: During a cybersecurity incident we use Elastic Agent to send Windows Events to Elastic Cloud. We send all the past events from that host that are available. As the detection rules run … --- ## [SIEM alert based on CVE](https://discuss.elastic.co/t/siem-alert-based-on-cve/311251)
**Author:** [@n2x4](https://discuss.elastic.co/u/n2x4)\ **Replies:** 7\ **Last updated:** [August 5, 2022, 2:23am UTC](https://discuss.elastic.co/t/siem-alert-based-on-cve/311251 "2022-08-05T02:23:57Z")
I'm currently ingesting vulnerability data into elastic, including CVE ID. I would like to generate an alert whenever a vulnerabilty is ingested that shows up on a predefined list of "priority" CVEs. I'm not quite sure … --- ## [Index mappings for elastic security](https://discuss.elastic.co/t/index-mappings-for-elastic-security/311341)
**Author:** [@rjconroy](https://discuss.elastic.co/u/rjconroy)\ **Replies:** 0\ **Last updated:** [August 3, 2022, 8:18pm UTC](https://discuss.elastic.co/t/index-mappings-for-elastic-security/311341 "2022-08-03T20:18:09Z")
Long story short im working on a custom project that uses a graylog front end, and im trying to figure out how to either have elastic security read the existing indexes graylog has written, or to have graylog write them … --- ## [Detection rules hitting all data tiers](https://discuss.elastic.co/t/detection-rules-hitting-all-data-tiers/310922)
**Author:** [@pushkarsawant](https://discuss.elastic.co/u/pushkarsawant)\ **Replies:** 5\ **Last updated:** [August 3, 2022, 1:46pm UTC](https://discuss.elastic.co/t/detection-rules-hitting-all-data-tiers/310922 "2022-08-03T13:46:13Z")
Hi, We are using elasticsearch detection engine to run detections through logs data. Most of our detection rules are executed against logs-\* index pattern. These rules run every 5 minutes with a look back of 4 minutes. … --- ## [Export rules into excel or CSV or PDF format](https://discuss.elastic.co/t/export-rules-into-excel-or-csv-or-pdf-format/311180)
**Author:** [@sunith](https://discuss.elastic.co/u/sunith)\ **Replies:** 2\ **Last updated:** [August 3, 2022, 6:29am UTC](https://discuss.elastic.co/t/export-rules-into-excel-or-csv-or-pdf-format/311180 "2022-08-03T06:29:54Z")
Hi, Kindly let me know is there a way to export all rules into readable CSV or excel or PDF format? Or is there a way to convert .ndjson export format to CSV or excel? Thanks in advance. --- ## [Fleet Server displaying as not Healthy](https://discuss.elastic.co/t/fleet-server-displaying-as-not-healthy/311064)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 0\ **Last updated:** [July 31, 2022, 10:17pm UTC](https://discuss.elastic.co/t/fleet-server-displaying-as-not-healthy/311064 "2022-07-31T22:17:12Z")
Hello there, Inside Kibana, my fleet server keeping show as not healthy and I´m trying to find out why but could not find a thing. The strange thing is that the same agent running the fleet server policy show as health… --- ## [Managing event filters outside the UI](https://discuss.elastic.co/t/managing-event-filters-outside-the-ui/310762)
**Author:** [@ryanturner03](https://discuss.elastic.co/u/ryanturner03)\ **Replies:** 3\ **Last updated:** [July 27, 2022, 10:12pm UTC](https://discuss.elastic.co/t/managing-event-filters-outside-the-ui/310762 "2022-07-27T22:12:37Z")
Hi all, I'm looking for a way to manage event filters across a number of deployments. Is there any API available to create / manage those or can it only be done in the UI? The feature I'm referring to: --- ## [Elastic Security Endpoint Security](https://discuss.elastic.co/t/elastic-security-endpoint-security/310802)
**Author:** [@Jared9922](https://discuss.elastic.co/u/Jared9922)\ **Replies:** 0\ **Last updated:** [July 27, 2022, 9:02pm UTC](https://discuss.elastic.co/t/elastic-security-endpoint-security/310802 "2022-07-27T21:02:44Z")
Hello, I am trying to setup endpoint security for our elastic stack and I am a little confused and I have a few questions. Firstly, to use endpoint security do you need to install elastic agent on each of your hosts? … --- ## [How do the Endpoint preventions work?](https://discuss.elastic.co/t/how-do-the-endpoint-preventions-work/310179)
**Author:** [@tmahany419](https://discuss.elastic.co/u/tmahany419)\ **Replies:** 2\ **Last updated:** [July 27, 2022, 12:49pm UTC](https://discuss.elastic.co/t/how-do-the-endpoint-preventions-work/310179 "2022-07-27T12:49:12Z")
On this page under the policies: If click the link to "related detection rules" it just shows all the elastic rules. How do I know which rules will prevent traffic because it is ransomeware? --- ## [My Macos elastic-endpoint process CPU is too high, up to 103%](https://discuss.elastic.co/t/my-macos-elastic-endpoint-process-cpu-is-too-high-up-to-103/310640)
**Author:** [@xqaiviwjxzw](https://discuss.elastic.co/u/xqaiviwjxzw)\ **Replies:** 3\ **Last updated:** [July 27, 2022, 7:55am UTC](https://discuss.elastic.co/t/my-macos-elastic-endpoint-process-cpu-is-too-high-up-to-103/310640 "2022-07-27T07:55:11Z")
My Macos elastic-endpoint process CPU is too high, up to 103%，It causes the computer to heat up badly, how can I solve this problem： --- ## [Deploy Elastic Agent 8.3.2 via Windows GPO](https://discuss.elastic.co/t/deploy-elastic-agent-8-3-2-via-windows-gpo/310689)
**Author:** [@bbs2web](https://discuss.elastic.co/u/bbs2web)\ **Replies:** 1\ **Last updated:** [July 26, 2022, 9:35pm UTC](https://discuss.elastic.co/t/deploy-elastic-agent-8-3-2-via-windows-gpo/310689 "2022-07-26T21:35:41Z")
Hi, The following is a working PowerShell script to deploy Elastic Agent to Windows workstations via Group Policy 'Startup Script'. Group Policy service by default does not include the permission for it to create SymLin… --- ## [Security events and rules matching](https://discuss.elastic.co/t/security-events-and-rules-matching/309922)
**Author:** [@Alexander\_A](https://discuss.elastic.co/u/Alexander_A)\ **Replies:** 2\ **Last updated:** [July 26, 2022, 4:49pm UTC](https://discuss.elastic.co/t/security-events-and-rules-matching/309922 "2022-07-26T16:49:20Z")
We are trying to understand what security events Elastic SIEM covers but it’s quite difficult cause there is no list of such events in the documentation or may be we don’t know where it is. We've decided to start with Wi… --- ## [Agent with Endpoint Security is not detected](https://discuss.elastic.co/t/agent-with-endpoint-security-is-not-detected/310385)
**Author:** [@Mr.Sucuk](https://discuss.elastic.co/u/Mr.Sucuk)\ **Replies:** 3\ **Last updated:** [July 25, 2022, 5:53pm UTC](https://discuss.elastic.co/t/agent-with-endpoint-security-is-not-detected/310385 "2022-07-25T17:53:36Z")
Dear all, my self managed fleet server is not able to detect the agends with endpoint integrations on the Endpoint menu. They tell me just to add/roll out a new agend with a token. But my deployment has got two agends w… --- ## [SIEM - Network scan](https://discuss.elastic.co/t/siem-network-scan/309691)
**Author:** [@ldmontoya](https://discuss.elastic.co/u/ldmontoya)\ **Replies:** 3\ **Last updated:** [July 22, 2022, 9:13am UTC](https://discuss.elastic.co/t/siem-network-scan/309691 "2022-07-22T09:13:47Z")
Hi guys! I'm setting up the SIEM feature on kibana and one of my use cases is to detect network scans using nmap or any other tool. After digging on the community I've found the following threshold rule: Query: event.c… --- ## [Creating a rule exception](https://discuss.elastic.co/t/creating-a-rule-exception/310292)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 1\ **Last updated:** [July 21, 2022, 10:44pm UTC](https://discuss.elastic.co/t/creating-a-rule-exception/310292 "2022-07-21T22:44:18Z")
Hello there, I would like to know if is possible creating a rule exception like: source.ip:192.168.0.1/24 destionation.ip:200.1.0.0.0/24 This kind of rule is to apply to the "SMB (Windows File Sharing) Activity to th… --- ## [VSS errors with Endpoint](https://discuss.elastic.co/t/vss-errors-with-endpoint/309224)
**Author:** [@twilson](https://discuss.elastic.co/u/twilson)\ **Replies:** 3\ **Last updated:** [July 21, 2022, 5:32am UTC](https://discuss.elastic.co/t/vss-errors-with-endpoint/309224 "2022-07-21T05:32:57Z")
After installing the Elastic agent and enabling the Endpoint integration, Windows servers are now throwing a VSS error whenever a shadow copy of a volume is made. In this case the timing of the errors corresponds to the… --- ## [Update to 8.3.1 from 8.3.0 has broken Fleet - please help!](https://discuss.elastic.co/t/update-to-8-3-1-from-8-3-0-has-broken-fleet-please-help/308654)
**Author:** [@finbarr996](https://discuss.elastic.co/u/finbarr996)\ **Replies:** 10\ **Last updated:** [July 20, 2022, 8:32am UTC](https://discuss.elastic.co/t/update-to-8-3-1-from-8-3-0-has-broken-fleet-please-help/308654 "2022-07-20T08:32:37Z")
Upgraded to 8.3 a few days ago - everything working fine. Updated to 8.3.1 this morning and now the elastic-agent service won't start on my single on-prem node - this is also the Fleet Server. Error in the logs is: Er… --- ## [256GB worth of logs accumulate over 24 hs](https://discuss.elastic.co/t/256gb-worth-of-logs-accumulate-over-24-hs/309904)
**Author:** [@ElasticUser11](https://discuss.elastic.co/u/ElasticUser11)\ **Replies:** 4\ **Last updated:** [July 18, 2022, 6:22pm UTC](https://discuss.elastic.co/t/256gb-worth-of-logs-accumulate-over-24-hs/309904 "2022-07-18T18:22:52Z")
I'm running a honeypot in a sandbox environment for testing purposes before I expose it to the Internet. Both the honeypot and Elastic seem to run fine on all fronts. The main issue I'm having is that despite the fair am… --- ## [Indicator Match Rule Failing from Rule Name](https://discuss.elastic.co/t/indicator-match-rule-failing-from-rule-name/309232)
**Author:** [@codewriterguy](https://discuss.elastic.co/u/codewriterguy)\ **Replies:** 6\ **Last updated:** [July 13, 2022, 10:43pm UTC](https://discuss.elastic.co/t/indicator-match-rule-failing-from-rule-name/309232 "2022-07-13T22:43:54Z")
Hi, I created an indicator match rule using intel from the Recorded Future integration package v1.0.1. The match rule appears to be failing from the rule name itself. Here is the error output: Rule failure at Jul 8, 2… [Previous page](https://discuss.elastic.co/c/security/83.md?page=29) [Next page](https://discuss.elastic.co/c/security/83.md?page=31)