# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=33 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 34 --- ## [How to extract rules and connector using elastic API](https://discuss.elastic.co/t/how-to-extract-rules-and-connector-using-elastic-api/303477)
**Author:** [@waelboss](https://discuss.elastic.co/u/waelboss)\ **Replies:** 1\ **Last updated:** [May 5, 2022, 9:53pm UTC](https://discuss.elastic.co/t/how-to-extract-rules-and-connector-using-elastic-api/303477 "2022-05-05T21:53:40Z")
i want to export rules and connector from elastic using API i created this request : curl -X POST -u elastic:pass https://myHOST:9243/api/detection\_engine/rules/\_export?exclude\_export\_details=true -H 'kbn-xsrf: true' -… --- ## [Elastic agent shows healthy (Also no error messages in Logs) in Kibana but fails to send data to elastic search](https://discuss.elastic.co/t/elastic-agent-shows-healthy-also-no-error-messages-in-logs-in-kibana-but-fails-to-send-data-to-elastic-search/302575)
**Author:** [@ajj31](https://discuss.elastic.co/u/ajj31)\ **Replies:** 5\ **Last updated:** [May 5, 2022, 7:29pm UTC](https://discuss.elastic.co/t/elastic-agent-shows-healthy-also-no-error-messages-in-logs-in-kibana-but-fails-to-send-data-to-elastic-search/302575 "2022-05-05T19:29:54Z")
v 7.17.2 - ELK Elastic Agent for EndPoint security gets enrolled and installed successfully. But instead of showing data received from elastic agent , it always goes to the attached screenshot " Next step: Enroll an … --- ## [Elastic Agent keeps updating - Fleet](https://discuss.elastic.co/t/elastic-agent-keeps-updating-fleet/303855)
**Author:** [@SamuelSMendes](https://discuss.elastic.co/u/SamuelSMendes)\ **Replies:** 2\ **Last updated:** [May 5, 2022, 7:01pm UTC](https://discuss.elastic.co/t/elastic-agent-keeps-updating-fleet/303855 "2022-05-05T19:01:42Z")
Hello everyone, I've been testing the Elastic Cloud by using the 14 days trial and so I wanted to check everything I could. Since I already used the APM agents with django and java on self-management, now on Cloud I've b… --- ## [Remove Ingest Processor](https://discuss.elastic.co/t/remove-ingest-processor/303848)
**Author:** [@bm11100](https://discuss.elastic.co/u/bm11100)\ **Replies:** 0\ **Last updated:** [May 3, 2022, 2:47pm UTC](https://discuss.elastic.co/t/remove-ingest-processor/303848 "2022-05-03T14:47:25Z")
I'm looking to re-index the .siem-signals-default index into an index called alerts and have created a pipeline to remove fields from the .siem-signals-default index. It looks similar to below - However, it doesn't … --- ## [Error: Get "http://unix/": dial unix /opt/Elastic/Agent/data/tmp/default/endpoint-security/endpoint-security.sock: connect: no such file or directory](https://discuss.elastic.co/t/error-get-http-unix-dial-unix-opt-elastic-agent-data-tmp-default-endpoint-security-endpoint-security-sock-connect-no-such-file-or-directory/303448)
**Author:** [@Tryp](https://discuss.elastic.co/u/Tryp)\ **Replies:** 4\ **Last updated:** [May 2, 2022, 2:03pm UTC](https://discuss.elastic.co/t/error-get-http-unix-dial-unix-opt-elastic-agent-data-tmp-default-endpoint-security-endpoint-security-sock-connect-no-such-file-or-directory/303448 "2022-05-02T14:03:43Z")
I've been digging into this for a few days now and I feel I've reached a wall. elastic-agent connects to both elastic and fleet and I can see the logs coming in. elastic-endpoint connects to fleet but refuses to conn… --- ## [27 default Elastic Security rules contain definitions to non-existant indices and are broken](https://discuss.elastic.co/t/27-default-elastic-security-rules-contain-definitions-to-non-existant-indices-and-are-broken/303043)
**Author:** [@finbarr996](https://discuss.elastic.co/u/finbarr996)\ **Replies:** 4\ **Last updated:** [April 26, 2022, 3:10pm UTC](https://discuss.elastic.co/t/27-default-elastic-security-rules-contain-definitions-to-non-existant-indices-and-are-broken/303043 "2022-04-26T15:10:30Z")
Hi there, As an example, the Elastic supplied default 'Endpoint Security' rule contains a hard coded definition to the index pattern 'logs-endpoint.alerts-\*' however, this index pattern does not exist and so this rule g… --- ## [Endpoint Security decraded/ Unhealthy status](https://discuss.elastic.co/t/endpoint-security-decraded-unhealthy-status/303031)
**Author:** [@fbijl](https://discuss.elastic.co/u/fbijl)\ **Replies:** 5\ **Last updated:** [April 26, 2022, 2:40pm UTC](https://discuss.elastic.co/t/endpoint-security-decraded-unhealthy-status/303031 "2022-04-26T14:40:14Z")
I have the same issue as described in this topic: And in the enpoint logfile: {"@timestamp":"2022-04-22T09:31:25.117229549Z","agent":{"id":"3b2a53b3-f192-49eb-adcc-ea5b040d5986","type":"endpoint"},"ecs":{"version":… --- ## [M365 Defender Logs integration- duplicated alerts from Defender for Endpoint](https://discuss.elastic.co/t/m365-defender-logs-integration-duplicated-alerts-from-defender-for-endpoint/303141)
**Author:** [@misiel](https://discuss.elastic.co/u/misiel)\ **Replies:** 0\ **Last updated:** [April 25, 2022, 9:46am UTC](https://discuss.elastic.co/t/m365-defender-logs-integration-duplicated-alerts-from-defender-for-endpoint/303141 "2022-04-25T09:46:29Z")
Hello! M365 Defender Logs integration is spamming with duplicated Microsft Defender for Endpoint alerts. It retrieves the same alerts every 5 minutes, even when the alerts and incidents are already marked as resoled in… --- ## [Darktrace integration](https://discuss.elastic.co/t/darktrace-integration/303030)
**Author:** [@Pim\_Bos](https://discuss.elastic.co/u/Pim_Bos)\ **Replies:** 1\ **Last updated:** [April 25, 2022, 9:26am UTC](https://discuss.elastic.co/t/darktrace-integration/303030 "2022-04-25T09:26:41Z")
Hi there, Currently I am using splunk for monitoring log. For consolidation reasons we like to migrate this to elastic. I am confident this will work in most cases, but one thing I am not so sure off. Splunk has an gre… --- ## [Updating the alerting for all rules with the API](https://discuss.elastic.co/t/updating-the-alerting-for-all-rules-with-the-api/303065)
**Author:** [@ARDiver86](https://discuss.elastic.co/u/ARDiver86)\ **Replies:** 0\ **Last updated:** [April 22, 2022, 11:20pm UTC](https://discuss.elastic.co/t/updating-the-alerting-for-all-rules-with-the-api/303065 "2022-04-22T23:20:02Z")
Since the ability to bulk edit rules and assign an action does not exist, how can I do this with the API? I've tried a few methods via the Kibana console under dev tools but cannot get any of the GET's to return data (li… --- ## [Ingest data to Elastic Security using third-party collectors configured to ship ECS-compliant data](https://discuss.elastic.co/t/ingest-data-to-elastic-security-using-third-party-collectors-configured-to-ship-ecs-compliant-data/303023)
**Author:** [@msilva](https://discuss.elastic.co/u/msilva)\ **Replies:** 0\ **Last updated:** [April 22, 2022, 11:25am UTC](https://discuss.elastic.co/t/ingest-data-to-elastic-security-using-third-party-collectors-configured-to-ship-ecs-compliant-data/303023 "2022-04-22T11:25:20Z")
Hi, In Ingest data to Elastic Security | Elastic Security Solution \[8.1\] | Elastic, it is mentioned that data can be ingested to Elastic Security using third-party collectors configured to ship ECS-compliant data. What… --- ## [Detecting a DDoS attack](https://discuss.elastic.co/t/detecting-a-ddos-attack/302941)
**Author:** [@quim.gomez](https://discuss.elastic.co/u/quim.gomez)\ **Replies:** 0\ **Last updated:** [April 21, 2022, 3:49pm UTC](https://discuss.elastic.co/t/detecting-a-ddos-attack/302941 "2022-04-21T15:49:35Z")
Hello, Today I would like to ask about DDoS and ELK security. I replicated a (modest) DDoS attack on my systems, and I got the correspondent logs and views. In Packetbeat Flows Dashboard it can be seen the moment wher… --- ## [Elastic SIEM Rules/Exceptions/Lists in Terraform](https://discuss.elastic.co/t/elastic-siem-rules-exceptions-lists-in-terraform/302628)
**Author:** [@operator-equals](https://discuss.elastic.co/u/operator-equals)\ **Replies:** 0\ **Last updated:** [April 18, 2022, 2:34pm UTC](https://discuss.elastic.co/t/elastic-siem-rules-exceptions-lists-in-terraform/302628 "2022-04-18T14:34:08Z")
Hello people! I created a repo to manage Rules and Exceptions/Lists in Terraform. Working with detection-rules repo \[1\], I needed to somehow keep a source of truth on what is deployed in the SIEM. So I created a Terraf… --- ## [PowerShell Keylogging Script potential False Positive](https://discuss.elastic.co/t/powershell-keylogging-script-potential-false-positive/299364)
**Author:** [@gicetek](https://discuss.elastic.co/u/gicetek)\ **Replies:** 2\ **Last updated:** [April 18, 2022, 3:36am UTC](https://discuss.elastic.co/t/powershell-keylogging-script-potential-false-positive/299364 "2022-04-18T03:36:07Z")
I recently enabled a number of the provided rules in our test Elasticsearch/Kibana/Winlogbeat configuration and am seeing alerts on the "PowerShell Keylogging Script" rule every time I run nearly any powershell command o… --- ## [Machine Learning Functionality Across Clusters](https://discuss.elastic.co/t/machine-learning-functionality-across-clusters/302514)
**Author:** [@Datt\_Mamon](https://discuss.elastic.co/u/Datt_Mamon)\ **Replies:** 3\ **Last updated:** [April 15, 2022, 7:33pm UTC](https://discuss.elastic.co/t/machine-learning-functionality-across-clusters/302514 "2022-04-15T19:33:07Z")
Hello Elastic Community! Running into an issue in my environment that I was hoping y'all could help with. My current architecture is divided into 3 clusters: RED1, BLUE1, and my Cross Cluster Search (CCS) cluster that h… --- ## [Are any of Elastic's products affected by CVE-2022-22965?](https://discuss.elastic.co/t/are-any-of-elastics-products-affected-by-cve-2022-22965/301576)
**Author:** [@xxgogogo](https://discuss.elastic.co/u/xxgogogo)\ **Replies:** 3\ **Last updated:** [April 15, 2022, 2:08pm UTC](https://discuss.elastic.co/t/are-any-of-elastics-products-affected-by-cve-2022-22965/301576 "2022-04-15T14:08:52Z")
Hi, Are any of Elastic's products(Elasticsearch, Kibana, and so on) affected by CVE-2022-22965? Link: https://tanzu.vmware.com/security/cve-2022-22965 Thanks! --- ## [Email trace logs in the Microsoft Office 365 integration](https://discuss.elastic.co/t/email-trace-logs-in-the-microsoft-office-365-integration/301649)
**Author:** [@dsv](https://discuss.elastic.co/u/dsv)\ **Replies:** 1\ **Last updated:** [April 14, 2022, 8:17am UTC](https://discuss.elastic.co/t/email-trace-logs-in-the-microsoft-office-365-integration/301649 "2022-04-14T08:17:05Z")
Hello, Is it possible to get the email trace logs (delivery status, sender, recipient, subject and attachments fields) in the Microsoft Office 365 integration in the Kibana 7.16.3? Some of these fields are presented at… --- ## [Deployement resources for our specific use case](https://discuss.elastic.co/t/deployement-resources-for-our-specific-use-case/302417)
**Author:** [@Kevin\_Hemelrijk](https://discuss.elastic.co/u/Kevin_Hemelrijk)\ **Replies:** 0\ **Last updated:** [April 14, 2022, 10:11am UTC](https://discuss.elastic.co/t/deployement-resources-for-our-specific-use-case/302417 "2022-04-14T10:11:12Z")
Hello Elastic Community, We are doing a case-study about how many resources we need if we deploy Elastic Security on the cloud. Our use-case is about 300+ Windows Servers, 50+ Linux servers and a couple hundred of endpo… --- ## [Send security cases to Slack](https://discuss.elastic.co/t/send-security-cases-to-slack/301207)
**Author:** [@samuelD](https://discuss.elastic.co/u/samuelD)\ **Replies:** 4\ **Last updated:** [April 13, 2022, 1:32pm UTC](https://discuss.elastic.co/t/send-security-cases-to-slack/301207 "2022-04-13T13:32:21Z")
Hello, I have an automatic system that creates security cases in my Elastic stack using the Kibana Endpoint. This part is working perfectly. Once an alert is created, I would like to automatically send a message on a S… --- ## [How to add client.ip to Alarm "stack by"?](https://discuss.elastic.co/t/how-to-add-client-ip-to-alarm-stack-by/302171)
**Author:** [@VellayLoket](https://discuss.elastic.co/u/VellayLoket)\ **Replies:** 1\ **Last updated:** [April 12, 2022, 1:12pm UTC](https://discuss.elastic.co/t/how-to-add-client-ip-to-alarm-stack-by/302171 "2022-04-12T13:12:43Z")
In the "Alerts" section, in the "Stack by" field, I see many fields other than the one I need (client.ip). How to add a field to this list? --- ## [Timeline Template not applied when Alert fires](https://discuss.elastic.co/t/timeline-template-not-applied-when-alert-fires/301950)
**Author:** [@PhilA](https://discuss.elastic.co/u/PhilA)\ **Replies:** 8\ **Last updated:** [April 12, 2022, 7:41am UTC](https://discuss.elastic.co/t/timeline-template-not-applied-when-alert-fires/301950 "2022-04-12T07:41:56Z")
Hi I am having issues with timeline templates. I have built a custom template showing some specific fields I would be interested in for blocked sessions thorugh a firewall. The timeline is configured and in the timeli… --- ## [Fleet Server is unstable. Can't connect new hosts but status is 'healthy'](https://discuss.elastic.co/t/fleet-server-is-unstable-cant-connect-new-hosts-but-status-is-healthy/299009)
**Author:** [@maof97](https://discuss.elastic.co/u/maof97)\ **Replies:** 17\ **Last updated:** [April 11, 2022, 12:34am UTC](https://discuss.elastic.co/t/fleet-server-is-unstable-cant-connect-new-hosts-but-status-is-healthy/299009 "2022-04-11T00:34:02Z")
Hello, since end of February I was not able to add new hosts to my fleet using my fleet server. Also I do not receive data from my Windows Domain Controller anymore for some reason. When I try to add another Windows Ho… --- ## [Waiting for Fleet Server to connect](https://discuss.elastic.co/t/waiting-for-fleet-server-to-connect/302027)
**Author:** [@maof97](https://discuss.elastic.co/u/maof97)\ **Replies:** 0\ **Last updated:** [April 9, 2022, 1:19pm UTC](https://discuss.elastic.co/t/waiting-for-fleet-server-to-connect/302027 "2022-04-09T13:19:26Z")
Hello, I tried to install a fleet server using the Kibana UI and copying the command to the CentOS Server. But after the successful enrollment the fleet server seems to stop itself for some reason and Kibana still "Wait… --- ## [Issue with rules creation](https://discuss.elastic.co/t/issue-with-rules-creation/301083)
**Author:** [@kesako](https://discuss.elastic.co/u/kesako)\ **Replies:** 14\ **Last updated:** [April 7, 2022, 1:56pm UTC](https://discuss.elastic.co/t/issue-with-rules-creation/301083 "2022-04-07T13:56:13Z")
Hello, I am trying to test some features of the SIEM integrated in ELK but I am stuck on the rules. In fact I am trying to put a rule where a alert is sent when a specific ip receives packets from another specific ip… --- ## [Rule Failure - Rule Mapping Error](https://discuss.elastic.co/t/rule-failure-rule-mapping-error/301827)
**Author:** [@inf](https://discuss.elastic.co/u/inf)\ **Replies:** 0\ **Last updated:** [April 7, 2022, 5:03am UTC](https://discuss.elastic.co/t/rule-failure-rule-mapping-error/301827 "2022-04-07T05:03:46Z")
Hi there, I am facing the same issue as Rules failing due to field mapping errors, except that I am using Winlogbeat. (instead of Auditbeat) I am also not using Logstash or any log transformation tools, and I am using … --- ## [Elastic Endpoint 8.1.1 - Memory usage crashing services](https://discuss.elastic.co/t/elastic-endpoint-8-1-1-memory-usage-crashing-services/301274)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 1\ **Last updated:** [April 6, 2022, 3:41pm UTC](https://discuss.elastic.co/t/elastic-endpoint-8-1-1-memory-usage-crashing-services/301274 "2022-04-06T15:41:28Z")
Well the locking issue is gone but the memory usage has started to climb from the generally 512Mb usage. At one point it took 100% memory and crashed services on several servers causing downtime and lost revenue. 7.17 … --- ## [ElasticEndpoint service registration in Windows stuck after uninstall](https://discuss.elastic.co/t/elasticendpoint-service-registration-in-windows-stuck-after-uninstall/301773)
**Author:** [@MichelV](https://discuss.elastic.co/u/MichelV)\ **Replies:** 3\ **Last updated:** [April 6, 2022, 3:17pm UTC](https://discuss.elastic.co/t/elasticendpoint-service-registration-in-windows-stuck-after-uninstall/301773 "2022-04-06T15:17:57Z")
Hi, after removing the Elastic Agent with Endpoint Security the service registration of ElasticEndpoint is stuck in Windows. In services I can see Elastic Endpoint, with "Failed to read description. Error code 2". Also … --- ## [AWS VPC Flow Log integration](https://discuss.elastic.co/t/aws-vpc-flow-log-integration/301712)
**Author:** [@ame123](https://discuss.elastic.co/u/ame123)\ **Replies:** 0\ **Last updated:** [April 6, 2022, 7:20am UTC](https://discuss.elastic.co/t/aws-vpc-flow-log-integration/301712 "2022-04-06T07:20:44Z")
Hi all, We have been trying since a month to stabilize the integration of vpc flow logs using elastic agent. There is always a lag of 2-3 days in the ingestion, the messages in the sqs queue never seems to do down beca… --- ## [Cisco Umbrella logs ingestion - Elastic Cloud](https://discuss.elastic.co/t/cisco-umbrella-logs-ingestion-elastic-cloud/301530)
**Author:** [@misiel](https://discuss.elastic.co/u/misiel)\ **Replies:** 4\ **Last updated:** [April 5, 2022, 1:21pm UTC](https://discuss.elastic.co/t/cisco-umbrella-logs-ingestion-elastic-cloud/301530 "2022-04-05T13:21:02Z")
Hello I started Elastic Cloud service trial period. I want to ingest Cisco Umbrella logs using Cisco Umbrella integration. Documentation says, that I have to install Elastic Agent in order to ship the logs (logs from se… --- ## [Edit pre-build rule](https://discuss.elastic.co/t/edit-pre-build-rule/301515)
**Author:** [@marti1](https://discuss.elastic.co/u/marti1)\ **Replies:** 1\ **Last updated:** [April 4, 2022, 4:08pm UTC](https://discuss.elastic.co/t/edit-pre-build-rule/301515 "2022-04-04T16:08:28Z")
Hi, Is it possible to edit pre-build rules? I would like to configure the output action (index connector) for each pre-build rule. It depends on the license? My current stack version: 7.16.2 Thx [Previous page](https://discuss.elastic.co/c/security/83.md?page=32) [Next page](https://discuss.elastic.co/c/security/83.md?page=34)