# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=35 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 36 --- ## [Elastic Endpoint Security Degraded](https://discuss.elastic.co/t/elastic-endpoint-security-degraded/298074)
**Author:** [@jobr97](https://discuss.elastic.co/u/jobr97)\ **Replies:** 3\ **Last updated:** [February 28, 2022, 5:41pm UTC](https://discuss.elastic.co/t/elastic-endpoint-security-degraded/298074 "2022-02-28T17:41:27Z")
Hi all, I'm having an issue with the Endpoint Security integration on my Windows devices. The agent status is showing up as "Unhealthy" and the status command on the endpoint gives the following result: Status: DEGRAD… --- ## [Can't see aws.cloudtrail logs in "Discover", but still getting Security Detections that uses aws.cloudtrail](https://discuss.elastic.co/t/cant-see-aws-cloudtrail-logs-in-discover-but-still-getting-security-detections-that-uses-aws-cloudtrail/298316)
**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Replies:** 2\ **Last updated:** [February 28, 2022, 2:50pm UTC](https://discuss.elastic.co/t/cant-see-aws-cloudtrail-logs-in-discover-but-still-getting-security-detections-that-uses-aws-cloudtrail/298316 "2022-02-28T14:50:54Z")
Can't see aws.cloudtrail logs in "Discover", but still getting Security Detections that uses aws.cloudtrail. Keep on restarting the agent that ships the AWS Cloudtrail logs, okta logs, Google Workspace logs, but AWS eve… --- ## [Upgrading Endgame appliance](https://discuss.elastic.co/t/upgrading-endgame-appliance/298273)
**Author:** [@pruttle](https://discuss.elastic.co/u/pruttle)\ **Replies:** 0\ **Last updated:** [February 25, 2022, 11:26am UTC](https://discuss.elastic.co/t/upgrading-endgame-appliance/298273 "2022-02-25T11:26:23Z")
Hi I have an Endgame appliance that needs nginx upgrading. Can I upgrade using the nginx repo or do I need to install a new appliance? According to this link it is now EOL. Elastic product end of life dates | Elastic T… --- ## [Can't create new line or use HTML in Detection email action](https://discuss.elastic.co/t/cant-create-new-line-or-use-html-in-detection-email-action/298315)
**Author:** [@kossde](https://discuss.elastic.co/u/kossde)\ **Replies:** 0\ **Last updated:** [February 25, 2022, 9:51pm UTC](https://discuss.elastic.co/t/cant-create-new-line-or-use-html-in-detection-email-action/298315 "2022-02-25T21:51:26Z")
I am trying to create a new email action for an alert but when it runs, everything appears on the same line. It doesn't appear to allow me to send HTML at all, so I can't use that to create a new line. I have tried /… --- ## [Elastic agent enrolls, then fails](https://discuss.elastic.co/t/elastic-agent-enrolls-then-fails/298306)
**Author:** [@patrickt333](https://discuss.elastic.co/u/patrickt333)\ **Replies:** 1\ **Last updated:** [February 25, 2022, 5:21pm UTC](https://discuss.elastic.co/t/elastic-agent-enrolls-then-fails/298306 "2022-02-25T17:21:22Z")
I have an on-prem install of Elasticsearch 7.16.3 on a Red Hat Enterprise Linux Server release 7.9 (Maipo). I had no issues installing Elasticsearch, kibana or fleet server, but when I enroll an agent, it is successful … --- ## [Need API information to get Elastic Agent status using kibana dev tool](https://discuss.elastic.co/t/need-api-information-to-get-elastic-agent-status-using-kibana-dev-tool/298265)
**Author:** [@niveditakathal](https://discuss.elastic.co/u/niveditakathal)\ **Replies:** 0\ **Last updated:** [February 25, 2022, 10:40am UTC](https://discuss.elastic.co/t/need-api-information-to-get-elastic-agent-status-using-kibana-dev-tool/298265 "2022-02-25T10:40:40Z")
Hi Everyone, I am looking for the API's that I can run from Kibana dev tool to get Elastic Agent status (as shown under Management \> Fleet \> Agents page). Please assist me with the guide or link where I can find suc… --- ## [Elastic Agent Enrollment Errors](https://discuss.elastic.co/t/elastic-agent-enrollment-errors/298203)
**Author:** [@secopsgeek](https://discuss.elastic.co/u/secopsgeek)\ **Replies:** 5\ **Last updated:** [February 25, 2022, 9:52am UTC](https://discuss.elastic.co/t/elastic-agent-enrollment-errors/298203 "2022-02-25T09:52:40Z")
Hello, I am having some problems enrolling linux and windows agent into Elastic Fleet services. This is the message I am getting: sudo ./elastic-agent enroll -f --fleet-server-es=https://172.16.100.6:8220 --fleet-serve… --- ## [Upgrading/Updating SIEM rules](https://discuss.elastic.co/t/upgrading-updating-siem-rules/298014)
**Author:** [@alaine](https://discuss.elastic.co/u/alaine)\ **Replies:** 2\ **Last updated:** [February 24, 2022, 7:13am UTC](https://discuss.elastic.co/t/upgrading-updating-siem-rules/298014 "2022-02-24T07:13:16Z")
Good Morning, I am in the process of migrating a SOC from Splunk to Elastic and am going through some of the growing pains at the moment. This question is in regards to upgrading/updating SIEM rules as we upgrade our el… --- ## [Windows Elastic Agent System Integration not pulling Security or Application events](https://discuss.elastic.co/t/windows-elastic-agent-system-integration-not-pulling-security-or-application-events/296507)
**Author:** [@n2x4](https://discuss.elastic.co/u/n2x4)\ **Replies:** 3\ **Last updated:** [February 23, 2022, 10:45pm UTC](https://discuss.elastic.co/t/windows-elastic-agent-system-integration-not-pulling-security-or-application-events/296507 "2022-02-23T22:45:42Z")
I have an Elastic Agent installed on a Windows Server and I've configured the system integration to pull Application, System, and Security logs. Only System logs are being collected and I can't find anything that indica… --- ## [SIEM doesn't display data but welcome page](https://discuss.elastic.co/t/siem-doesnt-display-data-but-welcome-page/297797)
**Author:** [@luis\_corral](https://discuss.elastic.co/u/luis_corral)\ **Replies:** 2\ **Last updated:** [February 22, 2022, 5:08am UTC](https://discuss.elastic.co/t/siem-doesnt-display-data-but-welcome-page/297797 "2022-02-22T05:08:04Z")
Hi all, We have implemented an instance of Elastic SIEM in our environment, and we're already receiving data on it that we can see in Kibana's tab, but if going to Security tab, only displays the welcome page to add age… --- ## [7.16.2 =\> Error loading map features in Security \> Network dashboard](https://discuss.elastic.co/t/7-16-2-error-loading-map-features-in-security-network-dashboard/293732)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 5\ **Last updated:** [February 21, 2022, 2:35pm UTC](https://discuss.elastic.co/t/7-16-2-error-loading-map-features-in-security-network-dashboard/293732 "2022-02-21T14:35:01Z")
Hello, Just noticed I'm getting "Error loading map features" errors in the Security Network Dashboard.. Found another (unaswered) thread about this =\> SIEM network map states "Error loading map features" at all end … --- ## [End point security fails for Elastic Agent with error "Missed two check-ins"](https://discuss.elastic.co/t/end-point-security-fails-for-elastic-agent-with-error-missed-two-check-ins/297477)
**Author:** [@ajj31](https://discuss.elastic.co/u/ajj31)\ **Replies:** 5\ **Last updated:** [February 18, 2022, 3:35am UTC](https://discuss.elastic.co/t/end-point-security-fails-for-elastic-agent-with-error-missed-two-check-ins/297477 "2022-02-18T03:35:34Z")
When I install elastic-agent and fleet-server against a successfully running https/SSL Elasticsearch and Kibana.....The output indicates a successful start and enrolment but a few minutes later the elastic-agent status i… --- ## [No agents under endpoint or host section in security](https://discuss.elastic.co/t/no-agents-under-endpoint-or-host-section-in-security/297514)
**Author:** [@Guncixx](https://discuss.elastic.co/u/Guncixx)\ **Replies:** 1\ **Last updated:** [February 17, 2022, 8:50pm UTC](https://discuss.elastic.co/t/no-agents-under-endpoint-or-host-section-in-security/297514 "2022-02-17T20:50:30Z")
Hi, We are testing out locally installed elk stack, enrolled agents to fleet and they are shown as healthy but in hosts section I see only fleet server and in endpoint section it just suggests to enroll agents, not show… --- ## [Detecting beaconing malware](https://discuss.elastic.co/t/detecting-beaconing-malware/296559)
**Author:** [@zerojin63](https://discuss.elastic.co/u/zerojin63)\ **Replies:** 7\ **Last updated:** [February 15, 2022, 9:35pm UTC](https://discuss.elastic.co/t/detecting-beaconing-malware/296559 "2022-02-15T21:35:59Z")
Hello, I saw this post (link) and wanted to try on my network log, so i followed the github manual (link), uploaded all the required scripts and changed only the transform script, just to apply it to my already existin… --- ## [Trying to create rules on elastic siem to map AD user information on another index](https://discuss.elastic.co/t/trying-to-create-rules-on-elastic-siem-to-map-ad-user-information-on-another-index/297230)
**Author:** [@sriramdas89](https://discuss.elastic.co/u/sriramdas89)\ **Replies:** 0\ **Last updated:** [February 15, 2022, 10:28am UTC](https://discuss.elastic.co/t/trying-to-create-rules-on-elastic-siem-to-map-ad-user-information-on-another-index/297230 "2022-02-15T10:28:37Z")
Hello All, I am importing event code 6273 from our NPS server and we have a rule set to alert us for the below condition. hosted on index: ds-logs-system.security-default.xxxxx 5 Failed logins with in a span for 5 minu… --- ## [EQL rules do not work but see hits](https://discuss.elastic.co/t/eql-rules-do-not-work-but-see-hits/297136)
**Author:** [@Why](https://discuss.elastic.co/u/Why)\ **Replies:** 2\ **Last updated:** [February 14, 2022, 10:45pm UTC](https://discuss.elastic.co/t/eql-rules-do-not-work-but-see-hits/297136 "2022-02-14T22:45:11Z")
Hello, I'm trying to get started with Elastic SIEM and I noticed a problem. To retrieve the logs, I use Auditbeat (for technical reasons, I can't use Elastic Agent). I have the impression that none of the rules writte… --- ## [Issue while Restore the indexes from snapshot backup](https://discuss.elastic.co/t/issue-while-restore-the-indexes-from-snapshot-backup/297047)
**Author:** [@indrajit\_kal](https://discuss.elastic.co/u/indrajit_kal)\ **Replies:** 0\ **Last updated:** [February 12, 2022, 10:34am UTC](https://discuss.elastic.co/t/issue-while-restore-the-indexes-from-snapshot-backup/297047 "2022-02-12T10:34:38Z")
\[backup\_repo:test-snapshot-2022.02.11-kxyy8jd4sumangv5kozy3q/9uLE7UaUQamgAH9pYbKAAA\] cannot restore index \[.siem-signals-default-000001\] because an open index with same name already exists in the cluster. Either close or… --- ## [Syntax error shown in EQL queries for correlation](https://discuss.elastic.co/t/syntax-error-shown-in-eql-queries-for-correlation/296836)
**Author:** [@wsouza](https://discuss.elastic.co/u/wsouza)\ **Replies:** 0\ **Last updated:** [February 10, 2022, 12:25pm UTC](https://discuss.elastic.co/t/syntax-error-shown-in-eql-queries-for-correlation/296836 "2022-02-10T12:25:26Z")
Hi folks! I'm running a query, through EQL, for event correlation, however, it's returning a syntax error. The strange thing is that the same query is made in another Elastic SIEM and it doesn't return an error. Has any… --- ## [Broken Fleet setup](https://discuss.elastic.co/t/broken-fleet-setup/296506)
**Author:** [@queried1](https://discuss.elastic.co/u/queried1)\ **Replies:** 2\ **Last updated:** [February 9, 2022, 4:34pm UTC](https://discuss.elastic.co/t/broken-fleet-setup/296506 "2022-02-09T16:34:41Z")
Hello! I recently wanted to setup Fleet on a working ELK cluster (self managed). By following this guide I did the initial steps: Add a Fleet Server | Fleet and Elastic Agent Guide \[7.17\] | Elastic (downloaded the pac… --- ## [Endpoint Security Intergration vs. Windows and System Intergrations](https://discuss.elastic.co/t/endpoint-security-intergration-vs-windows-and-system-intergrations/295731)
**Author:** [@TTCD](https://discuss.elastic.co/u/TTCD)\ **Replies:** 2\ **Last updated:** [February 9, 2022, 2:32pm UTC](https://discuss.elastic.co/t/endpoint-security-intergration-vs-windows-and-system-intergrations/295731 "2022-02-09T14:32:48Z")
Hey there, I need some help figuring out what the best practice is for collecting logs. What I would like to accomplish is to replace my current XDR solution with Elastic Endpoint Security (all without breaking the bank… --- ## [Question about whitelisting directories](https://discuss.elastic.co/t/question-about-whitelisting-directories/296343)
**Author:** [@zurb3](https://discuss.elastic.co/u/zurb3)\ **Replies:** 6\ **Last updated:** [February 9, 2022, 11:46am UTC](https://discuss.elastic.co/t/question-about-whitelisting-directories/296343 "2022-02-09T11:46:47Z")
I have a system that I would like to run elastic endpoint on that has a large network mounted file share. Every time I install it in the fleet policy, it causes the system to deadlock. I believe this is due to endpoint … --- ## [Custom EQL Query where one event happened and another didnt](https://discuss.elastic.co/t/custom-eql-query-where-one-event-happened-and-another-didnt/296524)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 0\ **Last updated:** [February 7, 2022, 9:29pm UTC](https://discuss.elastic.co/t/custom-eql-query-where-one-event-happened-and-another-didnt/296524 "2022-02-07T21:29:46Z")
Hello, Just wondering if it's possible to write an EQL query where event x happenend and event y did not happen for the same host after 0-2 minutes? Use case =\> Detecting messing with Eventlog Service Event ID 1100 is… --- ## [Threat Intel Indicator Rule: Request timed out](https://discuss.elastic.co/t/threat-intel-indicator-rule-request-timed-out/296408)
**Author:** [@maof97](https://discuss.elastic.co/u/maof97)\ **Replies:** 2\ **Last updated:** [February 7, 2022, 7:46pm UTC](https://discuss.elastic.co/t/threat-intel-indicator-rule-request-timed-out/296408 "2022-02-07T19:46:15Z")
Hello folks, I really like this Threat Intel feature in Elastic Security, but sadly I can't seem to make a single rule related to this work. They always fail: "Request timed out". I run ELK on a SSD with enough RAM for… --- ## [Feature Question around KPI Visualisation](https://discuss.elastic.co/t/feature-question-around-kpi-visualisation/296287)
**Author:** [@Gosborne](https://discuss.elastic.co/u/Gosborne)\ **Replies:** 0\ **Last updated:** [February 4, 2022, 11:50am UTC](https://discuss.elastic.co/t/feature-question-around-kpi-visualisation/296287 "2022-02-04T11:50:18Z")
I'm currently setting up Elastic Security as a single pane of glass for security information and event management. As part of this we have all our alerts being created in the detections pane with the SOC opening/closing … --- ## [Rules Authentication out of working time](https://discuss.elastic.co/t/rules-authentication-out-of-working-time/296364)
**Author:** [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\ **Replies:** 0\ **Last updated:** [February 5, 2022, 7:54pm UTC](https://discuss.elastic.co/t/rules-authentication-out-of-working-time/296364 "2022-02-05T19:54:57Z")
Hello Every body, I need a rule to detect authentication based on the event id 4624 (Windows authentication) out of working time. do you have any idea about this? Thanks, --- ## [Get list of installed packages with Elastic Agent](https://discuss.elastic.co/t/get-list-of-installed-packages-with-elastic-agent/296319)
**Author:** [@stenbot1](https://discuss.elastic.co/u/stenbot1)\ **Replies:** 0\ **Last updated:** [February 4, 2022, 2:53pm UTC](https://discuss.elastic.co/t/get-list-of-installed-packages-with-elastic-agent/296319 "2022-02-04T14:53:47Z")
I currently have an Elastic Stack that uses Auditbeats to ingest logs. I am able to use the Auditbeats to see which packages are installed in my environment looking at the Package fields. I am testing out moving from Aud… --- ## [Elastic-agent -- Sent logs to external SIEM](https://discuss.elastic.co/t/elastic-agent-sent-logs-to-external-siem/296045)
**Author:** [@fselim](https://discuss.elastic.co/u/fselim)\ **Replies:** 8\ **Last updated:** [February 4, 2022, 8:07am UTC](https://discuss.elastic.co/t/elastic-agent-sent-logs-to-external-siem/296045 "2022-02-04T08:07:47Z")
Goodmorning, We have installed elastic-agents throughout our environment with everything setup for filebeat and metricbeat monitoring. Though now I'm trying to figure out how to forward logs to an external SIEM when the… --- ## [Threat Intelligence Rule fails](https://discuss.elastic.co/t/threat-intelligence-rule-fails/293883)
**Author:** [@norgro2601](https://discuss.elastic.co/u/norgro2601)\ **Replies:** 2\ **Last updated:** [February 3, 2022, 8:45pm UTC](https://discuss.elastic.co/t/threat-intelligence-rule-fails/293883 "2022-02-03T20:45:06Z")
I want to use the rule "Threat Intel Filebeat Module (v7.x) Indicator Match", but it fails due to format of IPs in the records. The problem is the format in the fileset "abuseurl" in threatintel.indicator.ip, for example… --- ## [Event correlation rule that compares fields between the two events](https://discuss.elastic.co/t/event-correlation-rule-that-compares-fields-between-the-two-events/295633)
**Author:** [@kossde](https://discuss.elastic.co/u/kossde)\ **Replies:** 1\ **Last updated:** [February 3, 2022, 8:41pm UTC](https://discuss.elastic.co/t/event-correlation-rule-that-compares-fields-between-the-two-events/295633 "2022-02-03T20:41:47Z")
I am trying to create a rule that will determine if two VPN sessions were started for the same user from two different IP addresses without one session ending first. The problem I'm running into is that I can't figure … --- ## [Fleet Host healthy, but no data](https://discuss.elastic.co/t/fleet-host-healthy-but-no-data/295824)
**Author:** [@Billz1026](https://discuss.elastic.co/u/Billz1026)\ **Replies:** 4\ **Last updated:** [February 3, 2022, 3:19am UTC](https://discuss.elastic.co/t/fleet-host-healthy-but-no-data/295824 "2022-02-03T03:19:32Z")
Hi, I have configured fleet on my ES cluster and I can see all my endpoints are healthy under the Fleet\>Agents. But I cannot see either data stream or logs of the endpoints. when I go through the ES logs, I could fin… [Previous page](https://discuss.elastic.co/c/security/83.md?page=34) [Next page](https://discuss.elastic.co/c/security/83.md?page=36)