# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=31 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 32 --- ## [Elasic-agent is online but don't send data](https://discuss.elastic.co/t/elasic-agent-is-online-but-dont-send-data/256293)
**Author:** [@aloalo2242](https://discuss.elastic.co/u/aloalo2242)\ **Replies:** 12\ **Last updated:** [July 13, 2022, 9:40am UTC](https://discuss.elastic.co/t/elasic-agent-is-online-but-dont-send-data/256293 "2022-07-13T09:40:44Z")
Hi, I'm trying to use Elastic Agent and Ingest Manager. I have enroll 2 windows agent with fleet. Installation is ok. In Fleet Tab, Kibana, 2 agent is Online. But it don't send any data (Logs, Index Management, Dashboar… --- ## [Event filter for Elastict Agent and Endpoint Security](https://discuss.elastic.co/t/event-filter-for-elastict-agent-and-endpoint-security/309429)
**Author:** [@Axel\_zendata](https://discuss.elastic.co/u/Axel_zendata)\ **Replies:** 2\ **Last updated:** [July 13, 2022, 5:48am UTC](https://discuss.elastic.co/t/event-filter-for-elastict-agent-and-endpoint-security/309429 "2022-07-13T05:48:08Z")
Dear all, I created lot of event filter in Security -\> Event Filter for the Elastic Endpoint Agent, but it 's still impossible to use regular expression to exclude event (except for file.path.text). Do you have an id… --- ## [Indicator Match Rule Fails with too\_many\_nested\_clauses](https://discuss.elastic.co/t/indicator-match-rule-fails-with-too-many-nested-clauses/309233)
**Author:** [@codewriterguy](https://discuss.elastic.co/u/codewriterguy)\ **Replies:** 4\ **Last updated:** [July 12, 2022, 9:46pm UTC](https://discuss.elastic.co/t/indicator-match-rule-fails-with-too-many-nested-clauses/309233 "2022-07-12T21:46:03Z")
Hi, I created an indicator match rule using intel from the Recorded Future integration package v1.0.1 I am getting the following failure when the rule runs: Bulk Indexing of signals failed: ResponseError: search\_phase… --- ## [Elastic SIEM miss leading text on analyzer](https://discuss.elastic.co/t/elastic-siem-miss-leading-text-on-analyzer/309150)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 2\ **Last updated:** [July 7, 2022, 9:02pm UTC](https://discuss.elastic.co/t/elastic-siem-miss-leading-text-on-analyzer/309150 "2022-07-07T21:02:22Z")
Elastic Endpoint is Detect mode. All SIEM triggered alerts do the same for Endpoint injected events. Detect and Prevent should be clearly marked. In this example "Suspicious WMI Image Load from MS Office" is going to b… --- ## [Create multiple index for each agent policy](https://discuss.elastic.co/t/create-multiple-index-for-each-agent-policy/309151)
**Author:** [@dlazure](https://discuss.elastic.co/u/dlazure)\ **Replies:** 0\ **Last updated:** [July 7, 2022, 7:32pm UTC](https://discuss.elastic.co/t/create-multiple-index-for-each-agent-policy/309151 "2022-07-07T19:32:20Z")
Hi, I am trying to create different index per tenant on elastic cloud. I guess we need to assign the index per agent policy? What is the easiest way to do this Thank you --- ## [Akamai \<\> Elasticsearch integration](https://discuss.elastic.co/t/akamai-elasticsearch-integration/308795)
**Author:** [@hlopotun](https://discuss.elastic.co/u/hlopotun)\ **Replies:** 1\ **Last updated:** [July 7, 2022, 1:17pm UTC](https://discuss.elastic.co/t/akamai-elasticsearch-integration/308795 "2022-07-07T13:17:00Z")
Hello everyone! Hope someone could clarify the following for me. We have a self-hosted Elasticsearch cluster, no Fleet server yet. Recently we added the Akamai integration, provided all the necessary information (API H… --- ## [\[Error\] updating Security Data view - Velociraptor and Alerts](https://discuss.elastic.co/t/error-updating-security-data-view-velociraptor-and-alerts/308734)
**Author:** [@Stab\_Ilo](https://discuss.elastic.co/u/Stab_Ilo)\ **Replies:** 1\ **Last updated:** [July 4, 2022, 6:03am UTC](https://discuss.elastic.co/t/error-updating-security-data-view-velociraptor-and-alerts/308734 "2022-07-04T06:03:30Z")
Hi, I'm currently testing the ELK stack with the DFIR tool Velociraptor as an agent. My goal is to setup alerts on the received data from the Velociraptor Agent. However, I am trying to setup alerts in the Security: De… --- ## [Data sources for the predefined rules](https://discuss.elastic.co/t/data-sources-for-the-predefined-rules/307226)
**Author:** [@Barbarossa](https://discuss.elastic.co/u/Barbarossa)\ **Replies:** 1\ **Last updated:** [June 28, 2022, 11:38pm UTC](https://discuss.elastic.co/t/data-sources-for-the-predefined-rules/307226 "2022-06-28T23:38:48Z")
Hello everyone Is there a way to see which data sources and components are needed for a predefined rule to be triggered? Just like how MITRE ATT&CK shows which data sources/components are needed for a detection techniqu… --- ## [Plans to Support System Firewall Management?](https://discuss.elastic.co/t/plans-to-support-system-firewall-management/308388)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 0\ **Last updated:** [June 28, 2022, 6:38pm UTC](https://discuss.elastic.co/t/plans-to-support-system-firewall-management/308388 "2022-06-28T18:38:30Z")
Hi All, I was wondering if there are any plans to be able support the management of system firewalls via Endpoint Security/Elastic Agent? Context, if I want to have system level firewall rules, I currently need to mana… --- ## [Creating processor \[set\_security\_user\] (tag \[null\]) on field \[\_security\] but authentication is not currently enabled](https://discuss.elastic.co/t/creating-processor-set-security-user-tag-null-on-field-security-but-authentication-is-not-currently-enabled/306706)
**Author:** [@K\_st\_rs](https://discuss.elastic.co/u/K_st_rs)\ **Replies:** 7\ **Last updated:** [June 27, 2022, 10:38am UTC](https://discuss.elastic.co/t/creating-processor-set-security-user-tag-null-on-field-security-but-authentication-is-not-currently-enabled/306706 "2022-06-27T10:38:30Z")
Logs are filled every 4 minutes with below message on a test server and there is no help on this. I am fairly new to this and wouldn't have edited any files to a big extent. There is another thread on here (discuss.elast… --- ## [Parse json file](https://discuss.elastic.co/t/parse-json-file/307291)
**Author:** [@Roshan1](https://discuss.elastic.co/u/Roshan1)\ **Replies:** 0\ **Last updated:** [June 15, 2022, 2:53pm UTC](https://discuss.elastic.co/t/parse-json-file/307291 "2022-06-15T14:53:01Z")
Hello Team, grateful if you can help for the json parser. How can I modify the code below as per sample code? input { file { start\_position =\> "beginning" path =\> "/data/KONG1/logs/b0197a09e1f3d7de67d47bdbc5f33f5b06… --- ## [Create new Event Renderers](https://discuss.elastic.co/t/create-new-event-renderers/307382)
**Author:** [@kotvmrc](https://discuss.elastic.co/u/kotvmrc)\ **Replies:** 1\ **Last updated:** [June 16, 2022, 3:36pm UTC](https://discuss.elastic.co/t/create-new-event-renderers/307382 "2022-06-16T15:36:34Z")
Hi guys, I'm looking for creating/customizing "Events Renderers" the ones used inside the timelines or in the "Alerts" page. I've found only a little piece of configuration where I can select what renderer enable or no… --- ## [Error enroll fleet-server](https://discuss.elastic.co/t/error-enroll-fleet-server/306759)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 4\ **Last updated:** [June 15, 2022, 9:18am UTC](https://discuss.elastic.co/t/error-enroll-fleet-server/306759 "2022-06-15T09:18:39Z")
hey everyone, i just try to enroll fleet-agent. but its error. here's my command \> bin/elastic-agent enroll --url=https://192.168.88.147:8220 \\ \> --fleet-server-es=http://192.168.88.147:9200 \\ \> --fleet-server-serv… --- ## [Detection rule testing](https://discuss.elastic.co/t/detection-rule-testing/306911)
**Author:** [@kjjacobs57](https://discuss.elastic.co/u/kjjacobs57)\ **Replies:** 0\ **Last updated:** [June 10, 2022, 7:39pm UTC](https://discuss.elastic.co/t/detection-rule-testing/306911 "2022-06-10T19:39:15Z")
What is the process for testing detection rules that are part of the prebuilt detection rules? Does Elastic certify that prebuilt detections have been tested and work? --- ## [Elasticsearch storage full after activate endpoint security integration](https://discuss.elastic.co/t/elasticsearch-storage-full-after-activate-endpoint-security-integration/306754)
**Author:** [@ads92](https://discuss.elastic.co/u/ads92)\ **Replies:** 0\ **Last updated:** [June 9, 2022, 3:55am UTC](https://discuss.elastic.co/t/elasticsearch-storage-full-after-activate-endpoint-security-integration/306754 "2022-06-09T03:55:48Z")
I have 20 agent running that has the 'Endpoint Security', 'Prebuilt Security Detection Rules' and the 'System Integration'. This is running on a Windows 10/11 & Ubuntu 20.04 and reporting into ECK with fleet management … --- ## [Alert to connectors](https://discuss.elastic.co/t/alert-to-connectors/306598)
**Author:** [@dlazure](https://discuss.elastic.co/u/dlazure)\ **Replies:** 0\ **Last updated:** [June 7, 2022, 6:25pm UTC](https://discuss.elastic.co/t/alert-to-connectors/306598 "2022-06-07T18:25:12Z")
Hi, I am sending elastic security alerts to microsoft teams. I am using suricata for IDS and the alerts are sending fine, however, it always show External Alerts as the name. It does not provide the real alert name. I… --- ## [Security Events Filters vs. Ingest Node Pipelines](https://discuss.elastic.co/t/security-events-filters-vs-ingest-node-pipelines/306447)
**Author:** [@AndreiRD](https://discuss.elastic.co/u/AndreiRD)\ **Replies:** 0\ **Last updated:** [June 6, 2022, 12:33pm UTC](https://discuss.elastic.co/t/security-events-filters-vs-ingest-node-pipelines/306447 "2022-06-06T12:33:31Z")
Hi, What are the pros and cons of using Security Event Filters over the Ingest Node Pipelines for dropping unwanted log data? Ingest Pipelines seem to allow more granularity. --- ## [The following indices are missing the timestamp override field "event.ingested":](https://discuss.elastic.co/t/the-following-indices-are-missing-the-timestamp-override-field-event-ingested/306439)
**Author:** [@anushka1203](https://discuss.elastic.co/u/anushka1203)\ **Replies:** 0\ **Last updated:** [June 6, 2022, 11:04am UTC](https://discuss.elastic.co/t/the-following-indices-are-missing-the-timestamp-override-field-event-ingested/306439 "2022-06-06T11:04:25Z")
Hi, I have duplicated the "Potential Disabling of SELinux" rule, exported it and imported it again to add my custom index pattern (selinux\_index) by editing the NDJSON file. However I am getting the following warning an… --- ## [Remove or Reinstall Fleet Server](https://discuss.elastic.co/t/remove-or-reinstall-fleet-server/306346)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 0\ **Last updated:** [June 3, 2022, 4:49pm UTC](https://discuss.elastic.co/t/remove-or-reinstall-fleet-server/306346 "2022-06-03T16:49:01Z")
Hi there, I would like to know if there´s a way to remove or reinstall fleet server in another linux server box? Thanks for the attention --- ## [Threat Intel module with Fleet?](https://discuss.elastic.co/t/threat-intel-module-with-fleet/306112)
**Author:** [@slash24](https://discuss.elastic.co/u/slash24)\ **Replies:** 4\ **Last updated:** [June 3, 2022, 8:44am UTC](https://discuss.elastic.co/t/threat-intel-module-with-fleet/306112 "2022-06-03T08:44:30Z")
Hi, Im only using Fleet-managed workloads in my 7.17-cluster, using Windows, System and Endpoint-integrations. (so filebeat is being utilized on the workloads) Can I use the Threat Intel-module to enrich alerts, and if … --- ## [Endpoint Security Data (Rollup?)](https://discuss.elastic.co/t/endpoint-security-data-rollup/306217)
**Author:** [@forbiddenera](https://discuss.elastic.co/u/forbiddenera)\ **Replies:** 4\ **Last updated:** [June 2, 2022, 8:57pm UTC](https://discuss.elastic.co/t/endpoint-security-data-rollup/306217 "2022-06-02T20:57:26Z")
Hi, Hopefully this is the right place to post; if not, please move/direct me accordingly, :slight\_smile: I've enabled endpoint security on some of our systems, running under a fleet controlled elastic agent. Initially… --- ## [Endpoint Security Not Working](https://discuss.elastic.co/t/endpoint-security-not-working/304755)
**Author:** [@Reda-BELHAJ](https://discuss.elastic.co/u/Reda-BELHAJ)\ **Replies:** 3\ **Last updated:** [June 1, 2022, 4:31pm UTC](https://discuss.elastic.co/t/endpoint-security-not-working/304755 "2022-06-01T16:31:06Z")
Hey everyone, I am using an agent that have a personalised policy with: Endpoint Security Windows System And my issue is when I test a malicious behavior (with MITRE ATT&CK Techniques) I can't see the alerts and in m… --- ## [Mark a as closed an Alert take long time](https://discuss.elastic.co/t/mark-a-as-closed-an-alert-take-long-time/303777)
**Author:** [@rainierwolf](https://discuss.elastic.co/u/rainierwolf)\ **Replies:** 6\ **Last updated:** [June 1, 2022, 4:12pm UTC](https://discuss.elastic.co/t/mark-a-as-closed-an-alert-take-long-time/303777 "2022-06-01T16:12:50Z")
Hi team, I'm having a strange problem changing alert states in the security module. When I mark an alert as closed, it takes several minutes waiting until the system displays an error ("Failed to retrieve"). If I change… --- ## [Cloudflare integration Logpull not working](https://discuss.elastic.co/t/cloudflare-integration-logpull-not-working/306017)
**Author:** [@Guncixx](https://discuss.elastic.co/u/Guncixx)\ **Replies:** 2\ **Last updated:** [June 1, 2022, 5:45am UTC](https://discuss.elastic.co/t/cloudflare-integration-logpull-not-working/306017 "2022-06-01T05:45:20Z")
I have cloudflare integration set up and configured both audit logs and logpull logs, for some time it worked without a problem but couple days ago logpull logs stopped coming in. Nothing has been changed in integration … --- ## [Elastic agent and SvcHost DnsCache very high CPU usage](https://discuss.elastic.co/t/elastic-agent-and-svchost-dnscache-very-high-cpu-usage/304536)
**Author:** [@popeio](https://discuss.elastic.co/u/popeio)\ **Replies:** 8\ **Last updated:** [May 31, 2022, 9:16pm UTC](https://discuss.elastic.co/t/elastic-agent-and-svchost-dnscache-very-high-cpu-usage/304536 "2022-05-31T21:16:01Z")
Hi everyone, We've been happy users of the ELK stack and endpoint security components for quite some time now. During the past few months we've been living with occasional, weird performance issues which seem to be rela… --- ## [Security strategy on different server roles?](https://discuss.elastic.co/t/security-strategy-on-different-server-roles/305978)
**Author:** [@Ulrik](https://discuss.elastic.co/u/Ulrik)\ **Replies:** 0\ **Last updated:** [May 30, 2022, 9:21pm UTC](https://discuss.elastic.co/t/security-strategy-on-different-server-roles/305978 "2022-05-30T21:21:37Z")
Are there any best practices for how to setup and configure the Elastic monitoring on different server roles (IIS web server, MSSQL server, ...)? Is it reasonable to run Endpoint Security on a backend servers (SQL)? --- ## [Fleet Server - Error - x509: certificate is valid for 127.0.0.1, not x.x.x.x](https://discuss.elastic.co/t/fleet-server-error-x509-certificate-is-valid-for-127-0-0-1-not-x-x-x-x/305226)
**Author:** [@Carlos\_Vinicius](https://discuss.elastic.co/u/Carlos_Vinicius)\ **Replies:** 2\ **Last updated:** [May 30, 2022, 5:23pm UTC](https://discuss.elastic.co/t/fleet-server-error-x509-certificate-is-valid-for-127-0-0-1-not-x-x-x-x/305226 "2022-05-30T17:23:14Z")
Dear, good afternoon! I would like to ask for your support to solve a problem that I have been facing in the configuration of a fleet server in self mode, I created the CA, my Elasticsearch responds to HTTPS, I created … --- ## [Zombie process generated by elastic-agent](https://discuss.elastic.co/t/zombie-process-generated-by-elastic-agent/305569)
**Author:** [@gklink2](https://discuss.elastic.co/u/gklink2)\ **Replies:** 1\ **Last updated:** [May 30, 2022, 4:45pm UTC](https://discuss.elastic.co/t/zombie-process-generated-by-elastic-agent/305569 "2022-05-30T16:45:21Z")
after the host installed elastic-agent,we can found 2 zombie process, it can be solved after kill 9, but the host is offine,system restart dosen't work. command: ps aux | grep Z elastic-agent version:8.0.0---8.2.1 e… --- ## [Elastic Security - APIs on Resolver](https://discuss.elastic.co/t/elastic-security-apis-on-resolver/305958)
**Author:** [@inf](https://discuss.elastic.co/u/inf)\ **Replies:** 0\ **Last updated:** [May 30, 2022, 12:59pm UTC](https://discuss.elastic.co/t/elastic-security-apis-on-resolver/305958 "2022-05-30T12:59:00Z")
Hi there, I am trying to find out more about resolver-related APIs for Elastic Security, as I was not able to find any information about them from this page. These 3 HTTP requests were made (in the same order below) wh… --- ## [maxClauseCount is set to 1024 error when running "Threat Intel Filebeat Module (v8.x) Indicator Match" rule](https://discuss.elastic.co/t/maxclausecount-is-set-to-1024-error-when-running-threat-intel-filebeat-module-v8-x-indicator-match-rule/305757)
**Author:** [@Rorb](https://discuss.elastic.co/u/Rorb)\ **Replies:** 1\ **Last updated:** [May 30, 2022, 12:37am UTC](https://discuss.elastic.co/t/maxclausecount-is-set-to-1024-error-when-running-threat-intel-filebeat-module-v8-x-indicator-match-rule/305757 "2022-05-30T00:37:20Z")
I'm having some trouble when enabling the "Threat Intel Filebeat Module (v8.x) Indicator Match" rule, it fails with the error: Bulk Indexing of signals failed: index: ".ds-logs-generic-default-2022.05.26-000010" reason… [Previous page](https://discuss.elastic.co/c/security/83.md?page=30) [Next page](https://discuss.elastic.co/c/security/83.md?page=32)