# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=36 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 37 --- ## [Reading existing indexes not created by beats/agents](https://discuss.elastic.co/t/reading-existing-indexes-not-created-by-beats-agents/295098)
**Author:** [@rjconroy](https://discuss.elastic.co/u/rjconroy)\ **Replies:** 5\ **Last updated:** [February 2, 2022, 8:59am UTC](https://discuss.elastic.co/t/reading-existing-indexes-not-created-by-beats-agents/295098 "2022-02-02T08:59:22Z")
Im circling back to a past issue after getting pulled in another direction. Long story short what im trying to do is get elastic security to read existing elastic indexes that were not created by any beats or elastic sec… --- ## [Logs not showing in fleet](https://discuss.elastic.co/t/logs-not-showing-in-fleet/295690)
**Author:** [@Leviath](https://discuss.elastic.co/u/Leviath)\ **Replies:** 5\ **Last updated:** [February 1, 2022, 11:34am UTC](https://discuss.elastic.co/t/logs-not-showing-in-fleet/295690 "2022-02-01T11:34:50Z")
Good Morning, I have a fleet server with 2 hosts : The "kali" host has the following integrations installed with the elastic agent : I followed the installation steps from the elastic official webpage and the el… --- ## [Does elastic agent(7,16,3) contains all the beats?](https://discuss.elastic.co/t/does-elastic-agent-7-16-3-contains-all-the-beats/295817)
**Author:** [@boyd\_yang](https://discuss.elastic.co/u/boyd_yang)\ **Replies:** 1\ **Last updated:** [January 31, 2022, 3:13pm UTC](https://discuss.elastic.co/t/does-elastic-agent-7-16-3-contains-all-the-beats/295817 "2022-01-31T15:13:05Z")
How to enable the packetbeat in fleet? Should I install and configure packetbeat manually? The agent installed directory contains some beats: --- ## [Get the most out of Elastic Security - Ubuntu and Windows Servers](https://discuss.elastic.co/t/get-the-most-out-of-elastic-security-ubuntu-and-windows-servers/294977)
**Author:** [@PSFletchTheTek](https://discuss.elastic.co/u/PSFletchTheTek)\ **Replies:** 7\ **Last updated:** [January 31, 2022, 7:11pm UTC](https://discuss.elastic.co/t/get-the-most-out-of-elastic-security-ubuntu-and-windows-servers/294977 "2022-01-31T19:11:19Z")
Hi All, I'm looking at Elasticsearch security and how much I can use it. I have windows and ubuntu servers, Can anyone recommend which beats and modules are best to work with the SIEM to make sure its being feed with a… --- ## [Runtime Fields in Detection Rule](https://discuss.elastic.co/t/runtime-fields-in-detection-rule/295669)
**Author:** [@beijo](https://discuss.elastic.co/u/beijo)\ **Replies:** 4\ **Last updated:** [January 31, 2022, 5:53pm UTC](https://discuss.elastic.co/t/runtime-fields-in-detection-rule/295669 "2022-01-31T17:53:07Z")
Hello, I created a runtime field which I need to use in a detection rule, but I get no alerts. For the detection rule I used "Custom Query" (KQL) and I made sure to use the correct index pattern (the one where the runti… --- ## [Threshold rule : how to?](https://discuss.elastic.co/t/threshold-rule-how-to/295568)
**Author:** [@jfs1](https://discuss.elastic.co/u/jfs1)\ **Replies:** 2\ **Last updated:** [January 31, 2022, 3:53pm UTC](https://discuss.elastic.co/t/threshold-rule-how-to/295568 "2022-01-31T15:53:12Z")
Maybe stupid newbie question here. I want to create a rule that triggers an alert when "count(distinct(source.ip))" is above a certain threshold. Hard time figuring out how the 'Group by" and "Count" fields must be ass… --- ## [Cannot add a Fleet server](https://discuss.elastic.co/t/cannot-add-a-fleet-server/295670)
**Author:** [@Billz1026](https://discuss.elastic.co/u/Billz1026)\ **Replies:** 2\ **Last updated:** [January 28, 2022, 9:38am UTC](https://discuss.elastic.co/t/cannot-add-a-fleet-server/295670 "2022-01-28T09:38:09Z")
Hi All, I am using Elastic Security feature for some time using beats applications to collect logs from the endpoints. Recently I tried to check the Elastic Agent feature and I encountered following issues when I tried … --- ## [Kibana privilige to save Timelines or Cases, but without maintaining Rules](https://discuss.elastic.co/t/kibana-privilige-to-save-timelines-or-cases-but-without-maintaining-rules/295562)
**Author:** [@filip.wozniak](https://discuss.elastic.co/u/filip.wozniak)\ **Replies:** 0\ **Last updated:** [January 27, 2022, 9:23am UTC](https://discuss.elastic.co/t/kibana-privilige-to-save-timelines-or-cases-but-without-maintaining-rules/295562 "2022-01-27T09:23:37Z")
Greetings! I would like to assign privilige to save Timelines or Cases, but in the same time users mustn't maintain rules (edit; turning off/on etc.). Is it possible? I've tried with privilige Kibana -\> Security -\> All … --- ## [Processor and memory utilization on RDS servers](https://discuss.elastic.co/t/processor-and-memory-utilization-on-rds-servers/295415)
**Author:** [@ARDiver86](https://discuss.elastic.co/u/ARDiver86)\ **Replies:** 1\ **Last updated:** [January 27, 2022, 8:26pm UTC](https://discuss.elastic.co/t/processor-and-memory-utilization-on-rds-servers/295415 "2022-01-27T20:26:36Z")
We have recently started testing the endpoint product built in to Elastic and have noticed a considerable amount of CPU usage as well as higher memory utilization than one would expect. The CPU usage seems to mostly come… --- ## [Failing to get Detection Alerts](https://discuss.elastic.co/t/failing-to-get-detection-alerts/294032)
**Author:** [@subham](https://discuss.elastic.co/u/subham)\ **Replies:** 1\ **Last updated:** [January 27, 2022, 11:54am UTC](https://discuss.elastic.co/t/failing-to-get-detection-alerts/294032 "2022-01-27T11:54:50Z")
Hi All, I am getting below error while checking detection alerts. An error occurred during rule execution: message: "security\_exception" name: "iRule-testing2" id: "" rule id: "" signals index: ".siem-signals-security\_… --- ## [Creating a case for an alert automatically](https://discuss.elastic.co/t/creating-a-case-for-an-alert-automatically/294686)
**Author:** [@subham](https://discuss.elastic.co/u/subham)\ **Replies:** 2\ **Last updated:** [January 27, 2022, 11:52am UTC](https://discuss.elastic.co/t/creating-a-case-for-an-alert-automatically/294686 "2022-01-27T11:52:25Z")
Hey Everyone, Can anyone please tell if there's a way to create a case for an alert automatically. So that we dont have to do it manually. Thanks --- ## [Unable to seeing any lines (Host & Destination )on the Network tab in Elastic Security](https://discuss.elastic.co/t/unable-to-seeing-any-lines-host-destination-on-the-network-tab-in-elastic-security/295444)
**Author:** [@Rizwan\_Balouch](https://discuss.elastic.co/u/Rizwan_Balouch)\ **Replies:** 0\ **Last updated:** [January 26, 2022, 10:12am UTC](https://discuss.elastic.co/t/unable-to-seeing-any-lines-host-destination-on-the-network-tab-in-elastic-security/295444 "2022-01-26T10:12:31Z")
i am following the elastic blog " Collecting and analyzing Zeek data with Elastic Security" everything is working except I am not able to seeing any of the “pew pew” lines on the Network tab in Elastic Security. i ha… --- ## [Remove or Hide Kibana and Signal fields in Elastic Security](https://discuss.elastic.co/t/remove-or-hide-kibana-and-signal-fields-in-elastic-security/294804)
**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\ **Replies:** 8\ **Last updated:** [January 26, 2022, 6:44pm UTC](https://discuss.elastic.co/t/remove-or-hide-kibana-and-signal-fields-in-elastic-security/294804 "2022-01-26T18:44:45Z")
Version: 7.16.3 Hi, everyone I would like to know whether it is possible to remove or hide Kibana and Signal fields in Elastic Security. When an alert is triggered, you can look over it, here you are a screenshot: I… --- ## [Fleet and Suricata for Elastic Security](https://discuss.elastic.co/t/fleet-and-suricata-for-elastic-security/295455)
**Author:** [@Limoelou](https://discuss.elastic.co/u/Limoelou)\ **Replies:** 1\ **Last updated:** [January 26, 2022, 5:16pm UTC](https://discuss.elastic.co/t/fleet-and-suricata-for-elastic-security/295455 "2022-01-26T17:16:26Z")
Hello, I am a junior Cybersecurity Engineer and I have to build from scratch a SIEM that needs to monitor many hosts. Until now, I had several agents (filebeat, auditbeat, winlogbeat, suricata) installed on several ho… --- ## [Siem Rule Duplication - Query Not Changed Despite Rule Edit](https://discuss.elastic.co/t/siem-rule-duplication-query-not-changed-despite-rule-edit/295433)
**Author:** [@Ofir\_Edi](https://discuss.elastic.co/u/Ofir_Edi)\ **Replies:** 0\ **Last updated:** [January 26, 2022, 9:03am UTC](https://discuss.elastic.co/t/siem-rule-duplication-query-not-changed-despite-rule-edit/295433 "2022-01-26T09:03:21Z")
Hi, We are using SIEM in Kibana for threat detection. We have a rule which uses a saved query that we duplicated. On the new rule we changed chose custom query and inserted a different query in kql. What happens is tha… --- ## [How to change the External alert trend request](https://discuss.elastic.co/t/how-to-change-the-external-alert-trend-request/295094)
**Author:** [@wsouza](https://discuss.elastic.co/u/wsouza)\ **Replies:** 4\ **Last updated:** [January 24, 2022, 6:18pm UTC](https://discuss.elastic.co/t/how-to-change-the-external-alert-trend-request/295094 "2022-01-24T18:18:31Z")
Guys, I need to change the information on the External alert trend dashboard, however, I can't find the place to change the requests. The image shows what I want to change. --- ## [Upgrade fleet server to 7.16.2 - failing](https://discuss.elastic.co/t/upgrade-fleet-server-to-7-16-2-failing/294889)
**Author:** [@Ross\_Wakelin](https://discuss.elastic.co/u/Ross_Wakelin)\ **Replies:** 3\ **Last updated:** [January 24, 2022, 12:02pm UTC](https://discuss.elastic.co/t/upgrade-fleet-server-to-7-16-2-failing/294889 "2022-01-24T12:02:20Z")
We have been running fleet for a couple of months, starting with a stack running 7.15.0. We have upgraded our stack (including Kibana) to 7.16.2, and now want to upgrade our elastic-agents. On the fleet console, our ag… --- ## [Elastic Endpoint Security Data Sources](https://discuss.elastic.co/t/elastic-endpoint-security-data-sources/295052)
**Author:** [@beijo](https://discuss.elastic.co/u/beijo)\ **Replies:** 0\ **Last updated:** [January 21, 2022, 10:49am UTC](https://discuss.elastic.co/t/elastic-endpoint-security-data-sources/295052 "2022-01-21T10:49:08Z")
Hello, right now I'm testing the Elastic-Agent with the endpoint security integration in a lab environment and I'm very happy with it so far. Via integration settings we can define the events to be collected on windows… --- ## [Security rule exception not working](https://discuss.elastic.co/t/security-rule-exception-not-working/294811)
**Author:** [@masual](https://discuss.elastic.co/u/masual)\ **Replies:** 4\ **Last updated:** [January 21, 2022, 10:20am UTC](https://discuss.elastic.co/t/security-rule-exception-not-working/294811 "2022-01-21T10:20:31Z")
Hi everyone, We are using Elasticsearch and Kibana version 7.16.3. We have defined a security rule and added some exceptions to this rule. Some of the exceptions are working fine, filtering the events that match the e… --- ## [SIEM News feed on securitySolution:enableNewsFeed(Advance Settings) is not working](https://discuss.elastic.co/t/siem-news-feed-on-securitysolution-enablenewsfeed-advance-settings-is-not-working/295030)
**Author:** [@Ilias\_Kou](https://discuss.elastic.co/u/Ilias_Kou)\ **Replies:** 0\ **Last updated:** [January 21, 2022, 8:34am UTC](https://discuss.elastic.co/t/siem-news-feed-on-securitysolution-enablenewsfeed-advance-settings-is-not-working/295030 "2022-01-21T08:34:34Z")
I am trying to change the default news feed from https://feeds.elastic.co/security-solution to anything on this list for example https://www.reddit.com/r/netsecstudents/comments/5rtmu1/rss\_infosec\_news/ but I find no suc… --- ## [Upgrading elastic-agent on Ubuntu](https://discuss.elastic.co/t/upgrading-elastic-agent-on-ubuntu/294736)
**Author:** [@samiusan](https://discuss.elastic.co/u/samiusan)\ **Replies:** 2\ **Last updated:** [January 20, 2022, 4:59pm UTC](https://discuss.elastic.co/t/upgrading-elastic-agent-on-ubuntu/294736 "2022-01-20T16:59:07Z")
Hi, What is the best way of upgrading elastic-agent running on Ubuntu Linux when using a Fleet server? The Fleet console in Kibana does not give an option to upgrade these agents. I can upgrade elastic-agent running on… --- ## [Integration Differences - Fleet Policies](https://discuss.elastic.co/t/integration-differences-fleet-policies/294464)
**Author:** [@Huber](https://discuss.elastic.co/u/Huber)\ **Replies:** 2\ **Last updated:** [January 20, 2022, 4:12pm UTC](https://discuss.elastic.co/t/integration-differences-fleet-policies/294464 "2022-01-20T16:12:05Z")
Could someone please shed some light on those integrations System Integration and Windows they seem to be collecting the same type of logs ? Prebuilt Security Detection Rules - does this require Endpoint Security / In… --- ## [How to aggregate alerts?](https://discuss.elastic.co/t/how-to-aggregate-alerts/294654)
**Author:** [@VellayLoket](https://discuss.elastic.co/u/VellayLoket)\ **Replies:** 0\ **Last updated:** [January 18, 2022, 5:27am UTC](https://discuss.elastic.co/t/how-to-aggregate-alerts/294654 "2022-01-18T05:27:38Z")
So i have many alerts with the same cause (some maware send messages to C2) with the same source IP address. Can i aggregate such alerts in one (aggregation by source IP address)? --- ## [Elastic Security Integeration with Huawei firewall](https://discuss.elastic.co/t/elastic-security-integeration-with-huawei-firewall/293868)
**Author:** [@Rizwan\_Balouch](https://discuss.elastic.co/u/Rizwan_Balouch)\ **Replies:** 7\ **Last updated:** [January 14, 2022, 10:02am UTC](https://discuss.elastic.co/t/elastic-security-integeration-with-huawei-firewall/293868 "2022-01-14T10:02:59Z")
any idea about elastic security integration with Huawei firewall ? any workaround as Huawei integration is not listed in elastic security builtin integrations ? --- ## [SURICATA LOGS NOT SHOWING UP IN NETWORK EVENTS IN ELASTIC SIEM](https://discuss.elastic.co/t/suricata-logs-not-showing-up-in-network-events-in-elastic-siem/293176)
**Author:** [@mohammadawaisjavaid](https://discuss.elastic.co/u/mohammadawaisjavaid)\ **Replies:** 13\ **Last updated:** [January 14, 2022, 6:30am UTC](https://discuss.elastic.co/t/suricata-logs-not-showing-up-in-network-events-in-elastic-siem/293176 "2022-01-14T06:30:27Z")
Hi, I have installed elastic agent, on my host machine. I created a policy named suricata and I have added integrations of endpoint security and suricata. At the host end I have installed centos and have installed suric… --- ## [Variables in webhook](https://discuss.elastic.co/t/variables-in-webhook/294092)
**Author:** [@angelolol](https://discuss.elastic.co/u/angelolol)\ **Replies:** 4\ **Last updated:** [January 14, 2022, 1:27am UTC](https://discuss.elastic.co/t/variables-in-webhook/294092 "2022-01-14T01:27:20Z")
Hi, I created a rule with a post-action using webhook so how I can get source ip or hostname in the body . Thanks --- ## [Aggregating Case Information](https://discuss.elastic.co/t/aggregating-case-information/291836)
**Author:** [@bm11100](https://discuss.elastic.co/u/bm11100)\ **Replies:** 4\ **Last updated:** [January 14, 2022, 12:20am UTC](https://discuss.elastic.co/t/aggregating-case-information/291836 "2022-01-14T00:20:10Z")
Hello, I would like to aggregate case information monthly into certain reports, for example, how many cases were opened in the last month, status, etc.. I know all cases are stored as saved objects, and I was looking i… --- ## [Unable to seeing any of the “pew pew” lines on the Network tab in Elastic Security](https://discuss.elastic.co/t/unable-to-seeing-any-of-the-pew-pew-lines-on-the-network-tab-in-elastic-security/294283)
**Author:** [@Rizwan\_Balouch](https://discuss.elastic.co/u/Rizwan_Balouch)\ **Replies:** 0\ **Last updated:** [January 13, 2022, 1:56pm UTC](https://discuss.elastic.co/t/unable-to-seeing-any-of-the-pew-pew-lines-on-the-network-tab-in-elastic-security/294283 "2022-01-13T13:56:49Z")
i am following the elastic blog " Collecting and analyzing Zeek data with Elastic Security" everything is working except I am not able to seeing any of the “pew pew” lines on the Network tab in Elastic Security. i hav… --- ## [Unable to uninstall Endgame Sensor](https://discuss.elastic.co/t/unable-to-uninstall-endgame-sensor/258051)
**Author:** [@Greg\_Schles](https://discuss.elastic.co/u/Greg_Schles)\ **Replies:** 3\ **Last updated:** [January 12, 2022, 4:40pm UTC](https://discuss.elastic.co/t/unable-to-uninstall-endgame-sensor/258051 "2022-01-12T16:40:15Z")
Hello, I'm not able to remove an old sensor from some machines (Win 10). Command being ran: SensorWindowsInstaller-Sensor1.exe -c SensorWindowsInstaller-Sensor1.cfg -k API\_KEY\_REDACTED\_HERE -d false -l install.log L… --- ## [No data showing in SIEM Detection tab](https://discuss.elastic.co/t/no-data-showing-in-siem-detection-tab/293712)
**Author:** [@subham](https://discuss.elastic.co/u/subham)\ **Replies:** 4\ **Last updated:** [January 11, 2022, 6:03am UTC](https://discuss.elastic.co/t/no-data-showing-in-siem-detection-tab/293712 "2022-01-11T06:03:26Z")
Hi Everyone, We have create a detection rule threshold in SIEM but it's not showing any output or alerts. We can see the results in Preview Results but no alert is scene. Please check the image below for reference and su… [Previous page](https://discuss.elastic.co/c/security/83.md?page=35) [Next page](https://discuss.elastic.co/c/security/83.md?page=37)