# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=34 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 35 --- ## [Enabled building block option on rule but still mamy tickets](https://discuss.elastic.co/t/enabled-building-block-option-on-rule-but-still-mamy-tickets/301387)
**Author:** [@realtech2338](https://discuss.elastic.co/u/realtech2338)\ **Replies:** 0\ **Last updated:** [April 2, 2022, 12:02pm UTC](https://discuss.elastic.co/t/enabled-building-block-option-on-rule-but-still-mamy-tickets/301387 "2022-04-02T12:02:33Z")
The main pain for our analyst is noise. For instance we have brute force rules if it matches 100+ hits we need to get one ticket but we are getting 100 tickets generated on out ticketing tool zendesk. I have even enabled… --- ## [Assign Email Connector to Multiple Rules](https://discuss.elastic.co/t/assign-email-connector-to-multiple-rules/301148)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 1\ **Last updated:** [April 2, 2022, 10:05pm UTC](https://discuss.elastic.co/t/assign-email-connector-to-multiple-rules/301148 "2022-04-02T22:05:35Z")
Is there a way to assign the Email connector to multiple detection rule actions at once? Or do you have to set these rule actions for each individual rule? The documentation seems to indicate the latter, but this doesn't… --- ## [Elastic Endpoint 8.1 - File locking issues](https://discuss.elastic.co/t/elastic-endpoint-8-1-file-locking-issues/299253)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 19\ **Last updated:** [April 1, 2022, 4:35pm UTC](https://discuss.elastic.co/t/elastic-endpoint-8-1-file-locking-issues/299253 "2022-04-01T16:35:48Z")
Recently updated to 8.1 being it's only been out for a day... Endpoint is locking certain files which is stalling applications causing huge problems! This forces applications to crash and corrupt databases files. Only w… --- ## [Multi-tenancy in ES 8+](https://discuss.elastic.co/t/multi-tenancy-in-es-8/301132)
**Author:** [@tfriesen](https://discuss.elastic.co/u/tfriesen)\ **Replies:** 2\ **Last updated:** [March 30, 2022, 5:44pm UTC](https://discuss.elastic.co/t/multi-tenancy-in-es-8/301132 "2022-03-30T17:44:25Z")
Hi there I'm the process of architecting out a SIEM-as-a-service offering using Elasticsearch+Fleet, but I'm having a hard time finding good, recent documentation on multi-tenancy for modern versions of Elasticsearch an… --- ## [Elastic-security listening port](https://discuss.elastic.co/t/elastic-security-listening-port/300569)
**Author:** [@Guncixx](https://discuss.elastic.co/u/Guncixx)\ **Replies:** 1\ **Last updated:** [March 28, 2022, 7:09pm UTC](https://discuss.elastic.co/t/elastic-security-listening-port/300569 "2022-03-28T19:09:02Z")
Is it possible to change the port elastic-security service is listening on the localhost? Found that elastic is listening on 6788 and 6789 ports locally but those are reserved for other things on couple of our hosts and… --- ## [Elastic Detection Actions - any way to add fields?](https://discuss.elastic.co/t/elastic-detection-actions-any-way-to-add-fields/300764)
**Author:** [@kossde](https://discuss.elastic.co/u/kossde)\ **Replies:** 1\ **Last updated:** [March 28, 2022, 2:08pm UTC](https://discuss.elastic.co/t/elastic-detection-actions-any-way-to-add-fields/300764 "2022-03-28T14:08:22Z")
We are creating numerous threshold detections for a specific client. This client is asking the threshold detections to email them when the alert is triggered, but they are asking us to include details about the original… --- ## [Enable email Alerts for High Severity Detections](https://discuss.elastic.co/t/enable-email-alerts-for-high-severity-detections/300320)
**Author:** [@jbal24](https://discuss.elastic.co/u/jbal24)\ **Replies:** 2\ **Last updated:** [March 28, 2022, 11:59am UTC](https://discuss.elastic.co/t/enable-email-alerts-for-high-severity-detections/300320 "2022-03-28T11:59:44Z")
Hi All, How can I enable email Alerts for ALL High Severity Detections? Best regards, --- ## [Revenge NightLion Worm attacks my docker elasticsearch serveur](https://discuss.elastic.co/t/revenge-nightlion-worm-attacks-my-docker-elasticsearch-serveur/300815)
**Author:** [@Alan\_Digital](https://discuss.elastic.co/u/Alan_Digital)\ **Replies:** 0\ **Last updated:** [March 28, 2022, 8:55am UTC](https://discuss.elastic.co/t/revenge-nightlion-worm-attacks-my-docker-elasticsearch-serveur/300815 "2022-03-28T08:55:07Z")
Hi all, I don't find any information about this worm: read-me-hacked-by-nightlionsecurity-6kmeof Who knows how to protect my elastic server ? Thanks Alain --- ## [Rules don't trigger and preview window is empty](https://discuss.elastic.co/t/rules-dont-trigger-and-preview-window-is-empty/300137)
**Author:** [@Alex\_Bailey](https://discuss.elastic.co/u/Alex_Bailey)\ **Replies:** 6\ **Last updated:** [March 24, 2022, 9:26am UTC](https://discuss.elastic.co/t/rules-dont-trigger-and-preview-window-is-empty/300137 "2022-03-24T09:26:19Z")
Working with Elastic 8.1 stack and I can't seem to get rules to work for me no matter what I try. I have a rule defined as so: When I run the preview, this brings back no results: The request generated in this q… --- ## [Elastic Security Rule exception](https://discuss.elastic.co/t/elastic-security-rule-exception/300273)
**Author:** [@Billz1026](https://discuss.elastic.co/u/Billz1026)\ **Replies:** 1\ **Last updated:** [March 22, 2022, 12:20pm UTC](https://discuss.elastic.co/t/elastic-security-rule-exception/300273 "2022-03-22T12:20:25Z")
Hi, I have been using elastic security as a SIEM for my organization for some time. Due to insufficient space, I had deleted one index. Thereafter I saw failures of the detection rules which was not the case before. Be… --- ## [Can't use exception lists](https://discuss.elastic.co/t/cant-use-exception-lists/299635)
**Author:** [@bolemebrige](https://discuss.elastic.co/u/bolemebrige)\ **Replies:** 4\ **Last updated:** [March 22, 2022, 10:13am UTC](https://discuss.elastic.co/t/cant-use-exception-lists/299635 "2022-03-22T10:13:54Z")
After adding value lists through API or kibana interface they are not shown in Kibana and can't be added as exception to rules. If I update rule with exception list using API, it is shown in rule exceptions (but doesn't… --- ## [Update field on all SIEM detection Rules in one go](https://discuss.elastic.co/t/update-field-on-all-siem-detection-rules-in-one-go/299862)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 5\ **Last updated:** [March 21, 2022, 10:10pm UTC](https://discuss.elastic.co/t/update-field-on-all-siem-detection-rules-in-one-go/299862 "2022-03-21T22:10:29Z")
Hello all, We have created almost 400 + security rule under SIEM tab in Kibana. Now the new requirement come like they need to update one common field present in all the 400 rules. Can any one guide me how to achieve t… --- ## [CEF Logging not indexing field "event.original:"](https://discuss.elastic.co/t/cef-logging-not-indexing-field-event-original/299756)
**Author:** [@janis.cimins](https://discuss.elastic.co/u/janis.cimins)\ **Replies:** 4\ **Last updated:** [March 16, 2022, 1:57pm UTC](https://discuss.elastic.co/t/cef-logging-not-indexing-field-event-original/299756 "2022-03-16T13:57:04Z")
I have customer who ingests logs with CEF filebeat module. There is this field:"event.original:" and it does not index so it is not searchable. They ingest barracuda logs in this way. But I have trouble on setting up ba… --- ## [Fleet Server Problems](https://discuss.elastic.co/t/fleet-server-problems/299204)
**Author:** [@janis.cimins](https://discuss.elastic.co/u/janis.cimins)\ **Replies:** 2\ **Last updated:** [March 15, 2022, 12:21pm UTC](https://discuss.elastic.co/t/fleet-server-problems/299204 "2022-03-15T12:21:56Z")
Hello, I just installed newest Elastic SIEM on my system. All seems fine at this moment. I have filebeat set up on the server etc. But when I try endpoint security then I run into a problem and I get an error that I ca… --- ## [Elastic 7.5.1: http client did not trust this server's certificate](https://discuss.elastic.co/t/elastic-7-5-1-http-client-did-not-trust-this-servers-certificate/299704)
**Author:** [@yurii4](https://discuss.elastic.co/u/yurii4)\ **Replies:** 0\ **Last updated:** [March 15, 2022, 9:09am UTC](https://discuss.elastic.co/t/elastic-7-5-1-http-client-did-not-trust-this-servers-certificate/299704 "2022-03-15T09:09:05Z")
Hello I have a configured elasticearch.yml that includes these settings: xpack.security.enabled: true xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification\_mode: certificate xpack.securit… --- ## [Migration from ELK to Azure Sentinel](https://discuss.elastic.co/t/migration-from-elk-to-azure-sentinel/299703)
**Author:** [@tipper1510](https://discuss.elastic.co/u/tipper1510)\ **Replies:** 0\ **Last updated:** [March 15, 2022, 8:57am UTC](https://discuss.elastic.co/t/migration-from-elk-to-azure-sentinel/299703 "2022-03-15T08:57:57Z")
Hi, Wondering if there is any documents/process for ingesting events from elk to Azure Sentinel as part of a migration process. So the first step is to ensure any event raised in elk is sent to Azure so it can still be … --- ## [Send sophos logs via filebeat to elasticsearch ( ubuntu 20.04 )](https://discuss.elastic.co/t/send-sophos-logs-via-filebeat-to-elasticsearch-ubuntu-20-04/299641)
**Author:** [@khouloud1](https://discuss.elastic.co/u/khouloud1)\ **Replies:** 1\ **Last updated:** [March 14, 2022, 5:17pm UTC](https://discuss.elastic.co/t/send-sophos-logs-via-filebeat-to-elasticsearch-ubuntu-20-04/299641 "2022-03-14T17:17:25Z")
Hello , I have ubuntu 20.04 and want to send sophos (antivirus) logs via filebeat to Elasticsearch . I know that the module of sophos is supported by default for firewall and utm . Could you help please --- ## [PREVENT USER FROM DELETING INDEX](https://discuss.elastic.co/t/prevent-user-from-deleting-index/299322)
**Author:** [@Darshil\_Shah](https://discuss.elastic.co/u/Darshil_Shah)\ **Replies:** 3\ **Last updated:** [March 11, 2022, 12:39pm UTC](https://discuss.elastic.co/t/prevent-user-from-deleting-index/299322 "2022-03-11T12:39:58Z")
I have created one role from Kibana in which i have given read and write privilege , but the users are still able to delete index with \_delete\_by\_query API call. How can i prevent user from deleting index ? --- ## [Host Isolation over VPN](https://discuss.elastic.co/t/host-isolation-over-vpn/299356)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 1\ **Last updated:** [March 10, 2022, 6:11pm UTC](https://discuss.elastic.co/t/host-isolation-over-vpn/299356 "2022-03-10T18:11:51Z")
Hi All, I'm attempting to use host isolation on a device that uses a VPN to connect to Fleet. I've noticed that when I enable host isolation on the device, it completely stops responding and no longer works. I'm assumin… --- ## [Analyze fortigate logs with elastic security](https://discuss.elastic.co/t/analyze-fortigate-logs-with-elastic-security/299173)
**Author:** [@sawa00011](https://discuss.elastic.co/u/sawa00011)\ **Replies:** 0\ **Last updated:** [March 9, 2022, 6:40am UTC](https://discuss.elastic.co/t/analyze-fortigate-logs-with-elastic-security/299173 "2022-03-09T06:40:05Z")
I am logging Fortigate with Elastic Agent 7.16.3 and sending logs to Elastic Cloud. I would like to apply Elastic Security Rules to these logs and alert on them. There are about 650 rules by default, but I believe that… --- ## [No Data displaying in the System Windows Security Dashboard from Fleet Data Stream](https://discuss.elastic.co/t/no-data-displaying-in-the-system-windows-security-dashboard-from-fleet-data-stream/298869)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 0\ **Last updated:** [March 4, 2022, 5:27pm UTC](https://discuss.elastic.co/t/no-data-displaying-in-the-system-windows-security-dashboard-from-fleet-data-stream/298869 "2022-03-04T17:27:50Z")
Hello there, I configured the whole elk stack but for some reason I cannot see any data on dashboards provided by fleet data stream. That´s really strange coz I can see the logs coming throught: But when I click to … --- ## [Parsing message field from CEF logs](https://discuss.elastic.co/t/parsing-message-field-from-cef-logs/298392)
**Author:** [@janis.cimins](https://discuss.elastic.co/u/janis.cimins)\ **Replies:** 4\ **Last updated:** [March 8, 2022, 8:54am UTC](https://discuss.elastic.co/t/parsing-message-field-from-cef-logs/298392 "2022-03-08T08:54:45Z")
Hello all! I am really new to this whole Elasticsearch field. I have come across problem. I have built my Elastic SIEM laboratory and I have logs from on of my other products - Secret Server. I\`m receiving the logs just… --- ## [Missing index .siem-signals-default](https://discuss.elastic.co/t/missing-index-siem-signals-default/298452)
**Author:** [@slash24](https://discuss.elastic.co/u/slash24)\ **Replies:** 4\ **Last updated:** [March 7, 2022, 7:38pm UTC](https://discuss.elastic.co/t/missing-index-siem-signals-default/298452 "2022-03-07T19:38:50Z")
Having 7.16.3 properly licensed with Platinum, I cannot run some (tried five) ML-rules from Security due to: ".siem-signals-default" missing. I have Elastic Agent deployed with Security Endpoint activated and lots of d… --- ## [Infraestructure in Cloud](https://discuss.elastic.co/t/infraestructure-in-cloud/299007)
**Author:** [@WrongProvider](https://discuss.elastic.co/u/WrongProvider)\ **Replies:** 0\ **Last updated:** [March 7, 2022, 7:11pm UTC](https://discuss.elastic.co/t/infraestructure-in-cloud/299007 "2022-03-07T19:11:29Z")
Hi, people. My company and I wishes to use Elasticsearch for SIEM and possible XDR for our costumers -- we want to substitute Zabbix. But We can´t go on with the project because of the numerous questions about the infr… --- ## [Over 110 detections crash SIEM application and Kibana plugins](https://discuss.elastic.co/t/over-110-detections-crash-siem-application-and-kibana-plugins/295830)
**Author:** [@alaine](https://discuss.elastic.co/u/alaine)\ **Replies:** 18\ **Last updated:** [March 7, 2022, 5:59pm UTC](https://discuss.elastic.co/t/over-110-detections-crash-siem-application-and-kibana-plugins/295830 "2022-03-07T17:59:03Z")
Hello, I am having an issue that I have not been able to fix, and have not even been able to understand the underlying issue. I am running a cluster with 6 hot data nodes (virtual, SSD, 16 cpus, 64gb ram and 8TB disks) … --- ## [Elastic-Agent installed, but not viewable in Security Hosts tab or logs in Kibana](https://discuss.elastic.co/t/elastic-agent-installed-but-not-viewable-in-security-hosts-tab-or-logs-in-kibana/298524)
**Author:** [@nodes](https://discuss.elastic.co/u/nodes)\ **Replies:** 8\ **Last updated:** [March 7, 2022, 5:31pm UTC](https://discuss.elastic.co/t/elastic-agent-installed-but-not-viewable-in-security-hosts-tab-or-logs-in-kibana/298524 "2022-03-07T17:31:19Z")
Hi all - So I've recently got the Elastic Stack setup and running. Decided to go install the Fleet Server, and then install a handful of Elastic-Agents on Windows Server(s) to gather some logs and metrics. From the lo… --- ## [Kibana Security Timeline bad timestamp parsing](https://discuss.elastic.co/t/kibana-security-timeline-bad-timestamp-parsing/298991)
**Author:** [@Silver137](https://discuss.elastic.co/u/Silver137)\ **Replies:** 0\ **Last updated:** [March 7, 2022, 4:44pm UTC](https://discuss.elastic.co/t/kibana-security-timeline-bad-timestamp-parsing/298991 "2022-03-07T16:44:42Z")
I'm trying to investigate custom security events using Kibana timeline security features. My surprise when I see that the temporal searched works, but the timestamp is interpreted without adding the epoch offset, for ex… --- ## [False positive submit - Driver Genius](https://discuss.elastic.co/t/false-positive-submit-driver-genius/298928)
**Author:** [@Driver-Soft](https://discuss.elastic.co/u/Driver-Soft)\ **Replies:** 0\ **Last updated:** [March 7, 2022, 2:38am UTC](https://discuss.elastic.co/t/false-positive-submit-driver-genius/298928 "2022-03-07T02:38:09Z")
I followed your instruction and sent a false positive report to fp\_reports@elastic.co, but I haven't gotten a reply after a few days, please fix this false positive issue, thanks. Hello, Please fix the false positive… --- ## [Elastic Agent 8.0.0 on macOS 12.x](https://discuss.elastic.co/t/elastic-agent-8-0-0-on-macos-12-x/297945)
**Author:** [@teamomni](https://discuss.elastic.co/u/teamomni)\ **Replies:** 3\ **Last updated:** [March 3, 2022, 6:58pm UTC](https://discuss.elastic.co/t/elastic-agent-8-0-0-on-macos-12-x/297945 "2022-03-03T18:58:03Z")
We recently have been testing the Elastic Agent on various employees’ MacBook Pros (macOS 12.x with Intel processors) and are having permission issues. During installation we followed the guidelines provided on Enable F… --- ## [Elastic Agent enrolls but stuck in UPDATING status - not related to upgrade](https://discuss.elastic.co/t/elastic-agent-enrolls-but-stuck-in-updating-status-not-related-to-upgrade/298668)
**Author:** [@kfs](https://discuss.elastic.co/u/kfs)\ **Replies:** 0\ **Last updated:** [March 2, 2022, 7:37pm UTC](https://discuss.elastic.co/t/elastic-agent-enrolls-but-stuck-in-updating-status-not-related-to-upgrade/298668 "2022-03-02T19:37:06Z")
I have an issue with freshly deployed sytem: after (successfully) installing and enrolling agent to fleet, the agent status is foreverin UPDATING state and it appears to be not running, although the service is in running… [Previous page](https://discuss.elastic.co/c/security/83.md?page=33) [Next page](https://discuss.elastic.co/c/security/83.md?page=35)