# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=32 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 33 --- ## [Endpoint Security help](https://discuss.elastic.co/t/endpoint-security-help/305463)
**Author:** [@insurin](https://discuss.elastic.co/u/insurin)\ **Replies:** 6\ **Last updated:** [May 26, 2022, 7:19am UTC](https://discuss.elastic.co/t/endpoint-security-help/305463 "2022-05-26T07:19:36Z")
ELK 8.12 on Prem x1 server So far I have all my Active Directory domain controllers sending their logs into ELK server. This produces some great logs for me to view. I have added the Endpoint Security integration into m… --- ## [Need information on logs-endpoint.events.file@custom](https://discuss.elastic.co/t/need-information-on-logs-endpoint-events-file-custom/305460)
**Author:** [@niveditakathal](https://discuss.elastic.co/u/niveditakathal)\ **Replies:** 0\ **Last updated:** [May 24, 2022, 6:58am UTC](https://discuss.elastic.co/t/need-information-on-logs-endpoint-events-file-custom/305460 "2022-05-24T06:58:14Z")
Hi Experts, I want to add warm phase under logs ILM policy ; However, editing elastic provided ILM or templates is not recommended. hence I analyzed the existing logs template set up to create new template and ILM for … --- ## [Error with Security Rules](https://discuss.elastic.co/t/error-with-security-rules/303960)
**Author:** [@efadeev](https://discuss.elastic.co/u/efadeev)\ **Replies:** 8\ **Last updated:** [May 23, 2022, 8:58pm UTC](https://discuss.elastic.co/t/error-with-security-rules/303960 "2022-05-23T20:58:58Z")
I got an error with Security Rules in my Kibana. Both custom and pre-built rules. " An error occurred when reading the rule. Unauthorized to get a "siem.queryRule" rule for "siem"" Rules added under elastic user --- ## [Elastic Alerts](https://discuss.elastic.co/t/elastic-alerts/302823)
**Author:** [@Chihi\_Imen](https://discuss.elastic.co/u/Chihi_Imen)\ **Replies:** 2\ **Last updated:** [May 20, 2022, 9:53am UTC](https://discuss.elastic.co/t/elastic-alerts/302823 "2022-05-20T09:53:15Z")
The alert does not match, please fix the problem Thanks --- ## [Kibana -\> Security -\> elastic rules space issue](https://discuss.elastic.co/t/kibana-security-elastic-rules-space-issue/301861)
**Author:** [@niveditakathal](https://discuss.elastic.co/u/niveditakathal)\ **Replies:** 4\ **Last updated:** [May 20, 2022, 9:19am UTC](https://discuss.elastic.co/t/kibana-security-elastic-rules-space-issue/301861 "2022-05-20T09:19:27Z")
Hello Experts, I need some more insight on .siem-security index creation by kibana. We have created 3 spaces in kibana and enabled the same Security -\> elastic rules under all 3 spaces (eg: Whitespace Padding in Proces… --- ## [Rules and Connectors: Include Original Event](https://discuss.elastic.co/t/rules-and-connectors-include-original-event/305189)
**Author:** [@tomx1](https://discuss.elastic.co/u/tomx1)\ **Replies:** 0\ **Last updated:** [May 19, 2022, 12:52pm UTC](https://discuss.elastic.co/t/rules-and-connectors-include-original-event/305189 "2022-05-19T12:52:58Z")
I'm playing around with Kibana alert rules in combination with an index connector. I've successfully created an alert based on a search query which indexes an event to a defined index "Elasticsearch-alerting" if a resul… --- ## [Elastic Endpoint Security installation in scale](https://discuss.elastic.co/t/elastic-endpoint-security-installation-in-scale/305153)
**Author:** [@Idan\_Abramovich](https://discuss.elastic.co/u/Idan_Abramovich)\ **Replies:** 1\ **Last updated:** [May 19, 2022, 5:31pm UTC](https://discuss.elastic.co/t/elastic-endpoint-security-installation-in-scale/305153 "2022-05-19T17:31:11Z")
Hi , Do you have any idea how to install the Endpoint Security on about 1000 ~ Machines? Thank you! --- ## [Agent unhealthy after adding Network Packet Capture BETA integration](https://discuss.elastic.co/t/agent-unhealthy-after-adding-network-packet-capture-beta-integration/302785)
**Author:** [@rrivers](https://discuss.elastic.co/u/rrivers)\ **Replies:** 2\ **Last updated:** [May 19, 2022, 5:46am UTC](https://discuss.elastic.co/t/agent-unhealthy-after-adding-network-packet-capture-beta-integration/302785 "2022-05-19T05:46:25Z")
I added the "Network Packet Capture BETA" integration to a self managed 8.1.2 instance running on Ubuntu 20.04LTS. Shortly after adding that integration to one of the existing policies, fleet showed the agent status as … --- ## [Event Analyser error](https://discuss.elastic.co/t/event-analyser-error/305070)
**Author:** [@okopnik](https://discuss.elastic.co/u/okopnik)\ **Replies:** 0\ **Last updated:** [May 18, 2022, 12:44pm UTC](https://discuss.elastic.co/t/event-analyser-error/305070 "2022-05-18T12:44:18Z")
Hello, We're using Kibana 7.17.2 and trying to enable the Timelines and Event Renderers We're using an index named logs-sysmon containing Sysmon events We can see the process tree, but when trying to look on a specifi… --- ## [Event analyzer showing error](https://discuss.elastic.co/t/event-analyzer-showing-error/304930)
**Author:** [@okopnik](https://discuss.elastic.co/u/okopnik)\ **Replies:** 0\ **Last updated:** [May 17, 2022, 11:42am UTC](https://discuss.elastic.co/t/event-analyzer-showing-error/304930 "2022-05-17T11:42:45Z")
Hello, We're running an elastic stack consisting of Winlogbeat (7.16.1), Logstash (7.17.2), Elastic (7.17.2) and Kibana (7.17.2) nodes. We tried using the Timeline feature and analyzing events, but it prompts an error … --- ## [Create backup siem server with same integration](https://discuss.elastic.co/t/create-backup-siem-server-with-same-integration/304926)
**Author:** [@indrajit\_kal](https://discuss.elastic.co/u/indrajit_kal)\ **Replies:** 0\ **Last updated:** [May 17, 2022, 11:22am UTC](https://discuss.elastic.co/t/create-backup-siem-server-with-same-integration/304926 "2022-05-17T11:22:25Z")
if my live siem server is crash than how i connect my all elastic agent on new server which working on same elastic&kibana certificate and same IP. elastic version 7.17.\* please guide is it work or not. Thanks & regar… --- ## [Rules ( EMail variables Alerts )](https://discuss.elastic.co/t/rules-email-variables-alerts/304811)
**Author:** [@sbemiller](https://discuss.elastic.co/u/sbemiller)\ **Replies:** 4\ **Last updated:** [May 17, 2022, 12:25pm UTC](https://discuss.elastic.co/t/rules-email-variables-alerts/304811 "2022-05-17T12:25:38Z")
We have email alerts on two rules that stopped working upon the Update to 8.1.3 This example shown below is the Rule that shows the Windows Service Accounts that have failed log ons. I have this working as shown below a… --- ## [Seperate email alerts per detection?](https://discuss.elastic.co/t/seperate-email-alerts-per-detection/302112)
**Author:** [@Josh\_G](https://discuss.elastic.co/u/Josh_G)\ **Replies:** 2\ **Last updated:** [May 17, 2022, 8:58am UTC](https://discuss.elastic.co/t/seperate-email-alerts-per-detection/302112 "2022-05-17T08:58:23Z")
Hi Everyone, I've been doing some testing with the Email Alerts, to alert us when a specific event code is generated. I've done this under Security \> Rules, and it runs every 5 minutes. It works absolutely fine but the… --- ## [Elastic Agent not sending data to ES through proxy (Windows)](https://discuss.elastic.co/t/elastic-agent-not-sending-data-to-es-through-proxy-windows/303020)
**Author:** [@James\_Shaw](https://discuss.elastic.co/u/James_Shaw)\ **Replies:** 2\ **Last updated:** [May 16, 2022, 1:49pm UTC](https://discuss.elastic.co/t/elastic-agent-not-sending-data-to-es-through-proxy-windows/303020 "2022-05-16T13:49:04Z")
Hi all, Sorry if this has been asked before, but I am pretty much baffled now and can't get this working. Version: 1.17.1 Fleet Managed Agents. Problem: Elastic agents aren't sending data through the proxy to Elastic… --- ## [Elastic Agent + Proxy + Fleet Server in Cloud not ingesting logs](https://discuss.elastic.co/t/elastic-agent-proxy-fleet-server-in-cloud-not-ingesting-logs/303607)
**Author:** [@albertrc](https://discuss.elastic.co/u/albertrc)\ **Replies:** 1\ **Last updated:** [May 16, 2022, 11:33am UTC](https://discuss.elastic.co/t/elastic-agent-proxy-fleet-server-in-cloud-not-ingesting-logs/303607 "2022-05-16T11:33:46Z")
Hello, I'm facing some issues while trying to use Endpoint Security by installing Elastic Agent behind a proxy. Environment details: Elasticsearch and Fleet server in Cloud v8.1. Endpoints without access to Internet f… --- ## [Want Alert when New IP Found, How to do that?](https://discuss.elastic.co/t/want-alert-when-new-ip-found-how-to-do-that/304730)
**Author:** [@Dhia\_Saibi](https://discuss.elastic.co/u/Dhia_Saibi)\ **Replies:** 0\ **Last updated:** [May 14, 2022, 2:29pm UTC](https://discuss.elastic.co/t/want-alert-when-new-ip-found-how-to-do-that/304730 "2022-05-14T14:29:16Z")
Hi, I've parsed the logs to get new fields and specifically the client.ip field using this ingest piepline PUT \_ingest/pipeline/disscus-ip { "description": "", "processors": \[ { "grok": { "field":… --- ## [Fleet Server Error: Error - listen tcp: address https://myserver:8220: too many colons in address](https://discuss.elastic.co/t/fleet-server-error-error-listen-tcp-address-https-myserver-too-many-colons-in-address/303411)
**Author:** [@b0r1s](https://discuss.elastic.co/u/b0r1s)\ **Replies:** 2\ **Last updated:** [May 13, 2022, 1:12pm UTC](https://discuss.elastic.co/t/fleet-server-error-error-listen-tcp-address-https-myserver-too-many-colons-in-address/303411 "2022-05-13T13:12:36Z")
Hello fellows o/ I'm facing a problem to activate my Fleet Server. All my cluster is running on CentOS 7. I used rpm instalation of elastic-agent 7.15.2 and give the follow commands: On my Elasticsearch node 2 (where … --- ## [Fleet Error - undefined (reading 'preserve\_original\_event')](https://discuss.elastic.co/t/fleet-error-undefined-reading-preserve-original-event/304625)
**Author:** [@Derick\_Jansen](https://discuss.elastic.co/u/Derick_Jansen)\ **Replies:** 1\ **Last updated:** [May 13, 2022, 7:32am UTC](https://discuss.elastic.co/t/fleet-error-undefined-reading-preserve-original-event/304625 "2022-05-13T07:32:32Z")
Hey all Today when navigating to the fleet page I was welcomed with an error - Cannot read properties of undefined (reading 'preserve\_original\_event') No changes were made to any of our integrations and we have not set… --- ## [What is the best practice using KQL to filter desired attack signature over (web)logs?](https://discuss.elastic.co/t/what-is-the-best-practice-using-kql-to-filter-desired-attack-signature-over-web-logs/304371)
**Author:** [@Super\_Mario](https://discuss.elastic.co/u/Super_Mario)\ **Replies:** 0\ **Last updated:** [May 10, 2022, 3:36pm UTC](https://discuss.elastic.co/t/what-is-the-best-practice-using-kql-to-filter-desired-attack-signature-over-web-logs/304371 "2022-05-10T15:36:54Z")
Recently I'm experimenting with logstach and Kibana on top of elastic over (web-)server logs. I tried to extract some attack signature like XSS & SQL injection like the following examples when logs contain \< $ ' " ! .\\ %… --- ## [Lost all Fleet agent policies and Security Rules after upgrade to 8.2](https://discuss.elastic.co/t/lost-all-fleet-agent-policies-and-security-rules-after-upgrade-to-8-2/304389)
**Author:** [@robhep](https://discuss.elastic.co/u/robhep)\ **Replies:** 2\ **Last updated:** [May 11, 2022, 9:00pm UTC](https://discuss.elastic.co/t/lost-all-fleet-agent-policies-and-security-rules-after-upgrade-to-8-2/304389 "2022-05-11T21:00:45Z")
I have a cluster running in a lab that I use to test out things before we do them in production. This cluster started out on version 7.14.x roughly. Fleet and agents have been installed and upgraded several times, thro… --- ## [Installing ElasticAgent with GPO](https://discuss.elastic.co/t/installing-elasticagent-with-gpo/302250)
**Author:** [@kotvmrc](https://discuss.elastic.co/u/kotvmrc)\ **Replies:** 5\ **Last updated:** [May 11, 2022, 8:01am UTC](https://discuss.elastic.co/t/installing-elasticagent-with-gpo/302250 "2022-05-11T08:01:46Z")
Hi all, I'm looking for installing elastic-agent 7.16 on several Windows PCs with a GPO, EPs could be too many to install it manually. I can't find any guide to do it, so I tried to do it by myself creating a Powershel… --- ## [Sonicwall firewall SIEM](https://discuss.elastic.co/t/sonicwall-firewall-siem/251102)
**Author:** [@arturo.mj](https://discuss.elastic.co/u/arturo.mj)\ **Replies:** 14\ **Last updated:** [May 10, 2022, 1:27pm UTC](https://discuss.elastic.co/t/sonicwall-firewall-siem/251102 "2022-05-10T13:27:52Z")
Hi there, I have already connected my Sonicwall firewall to Elastic Cloud (I'm in the trial). I can see the logs in Kibana, but Elastic Security SIEM doesn't recognize the Firewall as a host, so I it doesn't get the log… --- ## [Custom integrations // the ability to install a tool for APT scaning](https://discuss.elastic.co/t/custom-integrations-the-ability-to-install-a-tool-for-apt-scaning/304251)
**Author:** [@A\_Abdellah](https://discuss.elastic.co/u/A_Abdellah)\ **Replies:** 0\ **Last updated:** [May 9, 2022, 12:33pm UTC](https://discuss.elastic.co/t/custom-integrations-the-ability-to-install-a-tool-for-apt-scaning/304251 "2022-05-09T12:33:28Z")
Hello, I'm checking the integrations developer guide, trying to build some custom integrations but I noticed that this documentation is strongly related to integrations based on #filebeat modules. my idea is to build a… --- ## [Detection Rules \_Severity override based on multiple values](https://discuss.elastic.co/t/detection-rules-severity-override-based-on-multiple-values/304010)
**Author:** [@sbianco1978](https://discuss.elastic.co/u/sbianco1978)\ **Replies:** 2\ **Last updated:** [May 9, 2022, 6:31am UTC](https://discuss.elastic.co/t/detection-rules-severity-override-based-on-multiple-values/304010 "2022-05-09T06:31:50Z")
Hello, I hope this is the correct section. I need an advice. When creating some detection rules I would need to perform a severity override based on differents "source field" values, for istance: Default severity: Me… --- ## [Automaticaly close SIEM case](https://discuss.elastic.co/t/automaticaly-close-siem-case/304195)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 1\ **Last updated:** [May 9, 2022, 2:25am UTC](https://discuss.elastic.co/t/automaticaly-close-siem-case/304195 "2022-05-09T02:25:11Z")
Hi all, I am tryiing to use shuffle soar to automate some of the task in the SIEM. One of them is the create and close cases. when i run the playbook the close case keep giving me error like this: These cases id has … --- ## [How to export results from alert page](https://discuss.elastic.co/t/how-to-export-results-from-alert-page/304156)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 1\ **Last updated:** [May 9, 2022, 12:34am UTC](https://discuss.elastic.co/t/how-to-export-results-from-alert-page/304156 "2022-05-09T00:34:56Z")
Hello there, I would like to know if is possible to export the results from the alert security page?? Thanks for the attention. --- ## [Feature request - Security Rule exception autopopulate](https://discuss.elastic.co/t/feature-request-security-rule-exception-autopopulate/302569)
**Author:** [@smzd](https://discuss.elastic.co/u/smzd)\ **Replies:** 2\ **Last updated:** [May 7, 2022, 6:19pm UTC](https://discuss.elastic.co/t/feature-request-security-rule-exception-autopopulate/302569 "2022-05-07T18:19:29Z")
would it be possible to auto populate all the fields when create a rule exception with the data coming from the alert. Then I can simply eliminate the fields that are not relevant. This will hugely simplify the process… --- ## [Get events of an specific rule](https://discuss.elastic.co/t/get-events-of-an-specific-rule/304073)
**Author:** [@Felipe\_Fuller](https://discuss.elastic.co/u/Felipe_Fuller)\ **Replies:** 3\ **Last updated:** [May 6, 2022, 2:43am UTC](https://discuss.elastic.co/t/get-events-of-an-specific-rule/304073 "2022-05-06T02:43:16Z")
Hi Community! I'm trying to obtain all the events of a specific rule. Since I didn't find an API that does the job, I inspected the Chome Network Dev tool. During the inspection, I saw a request done to /internal/bsearc… --- ## [False Positive Report - DriverGenius.exe](https://discuss.elastic.co/t/false-positive-report-drivergenius-exe/302615)
**Author:** [@Driver-Soft](https://discuss.elastic.co/u/Driver-Soft)\ **Replies:** 2\ **Last updated:** [May 6, 2022, 1:16am UTC](https://discuss.elastic.co/t/false-positive-report-drivergenius-exe/302615 "2022-05-06T01:16:25Z")
We followed your instruction to submitted a false positive report to fp\_reports@elastic.co 30 days ago but not get any reply. Hash: 2ceac1bdcc3718a4f824e41d62e690d089e84d284b37b6efef2cdbd5f545a80d Filename (Optional): D… --- ## [Is it possible to bulk edit all rules for certain fields?](https://discuss.elastic.co/t/is-it-possible-to-bulk-edit-all-rules-for-certain-fields/302686)
**Author:** [@Esha](https://discuss.elastic.co/u/Esha)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 10:20pm UTC](https://discuss.elastic.co/t/is-it-possible-to-bulk-edit-all-rules-for-certain-fields/302686 "2022-05-05T22:20:03Z")
Hi Team, Is it possible to bulk edit all rules for timestamp override field to use the event.ingested field? What is the recommended maximum search duration for a rule if there is any? [Previous page](https://discuss.elastic.co/c/security/83.md?page=31) [Next page](https://discuss.elastic.co/c/security/83.md?page=33)