# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=37 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 38 --- ## [External NIC Blocked by Elastic Agent](https://discuss.elastic.co/t/external-nic-blocked-by-elastic-agent/290772)
**Author:** [@teamomni](https://discuss.elastic.co/u/teamomni)\ **Replies:** 26\ **Last updated:** [January 10, 2022, 5:05pm UTC](https://discuss.elastic.co/t/external-nic-blocked-by-elastic-agent/290772 "2022-01-10T17:05:11Z")
We recently received our first MacBook Pro with an M1 ARM based processor and the external NIC appears to be blocked by the "ElasticEndpoint" that is running in the Network window. Our other MacBook Pros which are all I… --- ## [Enrollment Issue of fleet agent](https://discuss.elastic.co/t/enrollment-issue-of-fleet-agent/292655)
**Author:** [@MuhammadBilal](https://discuss.elastic.co/u/MuhammadBilal)\ **Replies:** 6\ **Last updated:** [January 10, 2022, 3:40pm UTC](https://discuss.elastic.co/t/enrollment-issue-of-fleet-agent/292655 "2022-01-10T15:40:02Z")
Hello, I m trying to integrate elastic endpoint security into my ELK stack, i have successfully install fleet and elastic agent to my endpoint but the issue is endpoint is not appearing in endpoint management in kibana. … --- ## [EQL correlation query help look up value within a message](https://discuss.elastic.co/t/eql-correlation-query-help-look-up-value-within-a-message/293474)
**Author:** [@krabel1ze](https://discuss.elastic.co/u/krabel1ze)\ **Replies:** 5\ **Last updated:** [January 10, 2022, 1:59pm UTC](https://discuss.elastic.co/t/eql-correlation-query-help-look-up-value-within-a-message/293474 "2022-01-10T13:59:08Z")
Hello! I want to created an Okta SSO authentication alert in Elastic.co based on geo-ip information. The query in LOGIC terms should look something like this: If client.user.id {133713371337} event.outcome == "success" … --- ## [Endgame Rules in cross cluster search](https://discuss.elastic.co/t/endgame-rules-in-cross-cluster-search/292199)
**Author:** [@Rainiur](https://discuss.elastic.co/u/Rainiur)\ **Replies:** 1\ **Last updated:** [January 7, 2022, 7:55pm UTC](https://discuss.elastic.co/t/endgame-rules-in-cross-cluster-search/292199 "2022-01-07T19:55:14Z")
I am trying to create a rule using the endgame metadata in a cross cluster search. Unfortunately I get the following error. This rule is attempting to query data from Elasticsearch indices listed in the "Index pattern" … --- ## [Set length limit and bottom scroll bar in Exceptions table](https://discuss.elastic.co/t/set-length-limit-and-bottom-scroll-bar-in-exceptions-table/292713)
**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\ **Replies:** 1\ **Last updated:** [January 7, 2022, 7:36pm UTC](https://discuss.elastic.co/t/set-length-limit-and-bottom-scroll-bar-in-exceptions-table/292713 "2022-01-07T19:36:41Z")
Version: Elasticsearch 7.16.2 & Kibana 7.16.2 Hi, everyone In the case of creating a rule with a long name may hinder exceptions workflow. For instance, if I create a rule with the name: Lorem Ipsum is simply dummy … --- ## [Threshold Rule type - not able to send more than three field values in email action](https://discuss.elastic.co/t/threshold-rule-type-not-able-to-send-more-than-three-field-values-in-email-action/292870)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 1\ **Last updated:** [January 7, 2022, 7:25pm UTC](https://discuss.elastic.co/t/threshold-rule-type-not-able-to-send-more-than-three-field-values-in-email-action/292870 "2022-01-07T19:25:45Z")
Continuing the discussion from Threshold Rule type - not able to send more than three field values in email action: --- ## [Wazuh SIEM + Winlogbeat](https://discuss.elastic.co/t/wazuh-siem-winlogbeat/292490)
**Author:** [@IvanYboa](https://discuss.elastic.co/u/IvanYboa)\ **Replies:** 2\ **Last updated:** [January 7, 2022, 6:21pm UTC](https://discuss.elastic.co/t/wazuh-siem-winlogbeat/292490 "2022-01-07T18:21:08Z")
Hi! I'm new at Elasticsearch and I'm implementing the SIEM Wazuh. The team of wazuh has their own agent to collect the logs, but in the company where I'm working want that some machines run the Wazuh agents and other ma… --- ## [Create Alert using connector Index](https://discuss.elastic.co/t/create-alert-using-connector-index/293324)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 1\ **Last updated:** [January 7, 2022, 5:44pm UTC](https://discuss.elastic.co/t/create-alert-using-connector-index/293324 "2022-01-07T17:44:08Z")
hello everyone, i wanna create alert ssh bruteforce but using "index" connector. because i dunno what index i will use and i dunno how to test it. --- ## [Elastic Agent No upgrade option Available](https://discuss.elastic.co/t/elastic-agent-no-upgrade-option-available/293738)
**Author:** [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Replies:** 1\ **Last updated:** [January 7, 2022, 5:09pm UTC](https://discuss.elastic.co/t/elastic-agent-no-upgrade-option-available/293738 "2022-01-07T17:09:26Z")
Hi all, I have a problem with some agents. I'm in version 7.16.1, I was able to upgrade most of my agents, but for some I have no option to upgrade.. The target systems (were the agents are installed) are redhat linux … --- ## [Linux\_anomalous\_process\_all\_hosts\_ecs apparently not only covering Linux, but full auditbeat](https://discuss.elastic.co/t/linux-anomalous-process-all-hosts-ecs-apparently-not-only-covering-linux-but-full-auditbeat/293519)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 2\ **Last updated:** [January 6, 2022, 8:35am UTC](https://discuss.elastic.co/t/linux-anomalous-process-all-hosts-ecs-apparently-not-only-covering-linux-but-full-auditbeat/293519 "2022-01-06T08:35:45Z")
Hello, I was a bit surprised to see the "Anomalous Process For a Linux Population" SIEM rule trigger for Windows hosts. After some investigation, I noticed there is no filter for host.os.type or host.os.family or sth s… --- ## [Osquery exported fields](https://discuss.elastic.co/t/osquery-exported-fields/293608)
**Author:** [@michaelv](https://discuss.elastic.co/u/michaelv)\ **Replies:** 1\ **Last updated:** [January 6, 2022, 4:07am UTC](https://discuss.elastic.co/t/osquery-exported-fields/293608 "2022-01-06T04:07:12Z")
I'm running 7.16.1 for everything. including elastic-agent-7.16.1-linux-x86\_64.tar.gz I have a question on osquery exported fields. From this URL: Osquery Manager | Elastic Docs It states that fields like interface\_… --- ## [Detection Rule - Output of a aggregation bucket should match with other types of logs in the same index](https://discuss.elastic.co/t/detection-rule-output-of-a-aggregation-bucket-should-match-with-other-types-of-logs-in-the-same-index/292869)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 1\ **Last updated:** [January 5, 2022, 1:40pm UTC](https://discuss.elastic.co/t/detection-rule-output-of-a-aggregation-bucket-should-match-with-other-types-of-logs-in-the-same-index/292869 "2022-01-05T13:40:33Z")
Continuing the discussion from Detection Rule - Output of a aggregation bucket should match with other types of logs in the same index: --- ## [Kibana SIEM and custom indexes](https://discuss.elastic.co/t/kibana-siem-and-custom-indexes/293186)
**Author:** [@ulysse31](https://discuss.elastic.co/u/ulysse31)\ **Replies:** 3\ **Last updated:** [January 4, 2022, 12:39pm UTC](https://discuss.elastic.co/t/kibana-siem-and-custom-indexes/293186 "2022-01-04T12:39:12Z")
Hello All, We have used Kibana SIEM essentially for network metadata retention, So historically, all network related metadata from various network filebeat modules (suricata, sonicwall, iptables, etc ...) ends up into s… --- ## [Elastic Agent - critical issues, filling up hard drive space](https://discuss.elastic.co/t/elastic-agent-critical-issues-filling-up-hard-drive-space/293304)
**Author:** [@Ndx](https://discuss.elastic.co/u/Ndx)\ **Replies:** 1\ **Last updated:** [January 3, 2022, 2:40am UTC](https://discuss.elastic.co/t/elastic-agent-critical-issues-filling-up-hard-drive-space/293304 "2022-01-03T02:40:15Z")
@ferullo I think there might be critical bug in elastic agent - today all servers ( system drives were filled up ) server 2012, 2016, 2019, Win 10 machines as well. Files in C:\\Program Files\\Elastic\\Endpoint\\state\\log\\… --- ## [Dealing with False Positives](https://discuss.elastic.co/t/dealing-with-false-positives/292941)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 1\ **Last updated:** [December 29, 2021, 1:50pm UTC](https://discuss.elastic.co/t/dealing-with-false-positives/292941 "2021-12-29T13:50:59Z")
Hey, I've discovered a false positive in the rule Suspicious JAVA Child Process (which is quite scary at this time of the year...) with the meeting-software Jitsi that should affect some other people. Is there currently… --- ## [Installing elastic agent on oracle linux](https://discuss.elastic.co/t/installing-elastic-agent-on-oracle-linux/292975)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 0\ **Last updated:** [December 27, 2021, 1:34pm UTC](https://discuss.elastic.co/t/installing-elastic-agent-on-oracle-linux/292975 "2021-12-27T13:34:11Z")
Hi, I need to install elastic-agent on Oracle Linux and being a Redhat linux I believe it should not be any problem. However any idea how to install ca.crt file in Red hat or Oracle linux so that while running fleet age… --- ## [Log4j auditbeat detection rule](https://discuss.elastic.co/t/log4j-auditbeat-detection-rule/292332)
**Author:** [@fgjensen](https://discuss.elastic.co/u/fgjensen)\ **Replies:** 1\ **Last updated:** [December 29, 2021, 12:45pm UTC](https://discuss.elastic.co/t/log4j-auditbeat-detection-rule/292332 "2021-12-29T12:45:13Z")
Hello Referring to this blog post I am trying to configure the auditbeat detection rule in Kibana 7.16.1 as a new event correlation rule. However when I past the rule into the EQL form this error is reported: verifica… --- ## [Netflow and IIS with Elastic](https://discuss.elastic.co/t/netflow-and-iis-with-elastic/292595)
**Author:** [@Sharjeel](https://discuss.elastic.co/u/Sharjeel)\ **Replies:** 2\ **Last updated:** [December 27, 2021, 2:14am UTC](https://discuss.elastic.co/t/netflow-and-iis-with-elastic/292595 "2021-12-27T02:14:57Z")
Hi there, I am new here and would like to clear some confusion. I would like to implement Netflow and IIS module (to capture IIS logs). Are those modules free and how can I implement them? Do I need ELK or SIEM for that… --- ## [Osquery results don't come in: "matching app is not found for action input: osquery"](https://discuss.elastic.co/t/osquery-results-dont-come-in-matching-app-is-not-found-for-action-input-osquery/292381)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 6\ **Last updated:** [December 20, 2021, 11:14pm UTC](https://discuss.elastic.co/t/osquery-results-dont-come-in-matching-app-is-not-found-for-action-input-osquery/292381 "2021-12-20T23:14:45Z")
Hey, unfortunately, I managed to break my OSQuery integrations again. A simple query like SELECT \* FROM os\_version; yields the error message matching app is not found for action input: osquery for most of my hosts. Ed… --- ## [Error: fail to checkin to fleet-server](https://discuss.elastic.co/t/error-fail-to-checkin-to-fleet-server/292453)
**Author:** [@IrekOp](https://discuss.elastic.co/u/IrekOp)\ **Replies:** 0\ **Last updated:** [December 20, 2021, 11:23am UTC](https://discuss.elastic.co/t/error-fail-to-checkin-to-fleet-server/292453 "2021-12-20T11:23:17Z")
Hi! I'm using Elastic Cloud SIEM My elastic agent is installed in AWS on EC2 Elastic agent has policy with integrations: system (send system logs & metrics), fleet server & office 365 Logs (module integration) On Frid… --- ## [Log4j vulnerability threat impact on Elasticsearch 2.3.4 and Logstash 2.3.4](https://discuss.elastic.co/t/log4j-vulnerability-threat-impact-on-elasticsearch-2-3-4-and-logstash-2-3-4/292110)
**Author:** [@angshuman.ray](https://discuss.elastic.co/u/angshuman.ray)\ **Replies:** 1\ **Last updated:** [December 20, 2021, 12:06am UTC](https://discuss.elastic.co/t/log4j-vulnerability-threat-impact-on-elasticsearch-2-3-4-and-logstash-2-3-4/292110 "2021-12-20T00:06:02Z")
Can any one please provide information on Log4j vulnerability threat impact on Elasticsearch 2.3.4 and Logstash 2.3.4. These are very old versions. If any resolution possible without upgrading the stack. --- ## [SIEM Event Correlation rule returns no data](https://discuss.elastic.co/t/siem-event-correlation-rule-returns-no-data/291197)
**Author:** [@pruttle](https://discuss.elastic.co/u/pruttle)\ **Replies:** 3\ **Last updated:** [December 17, 2021, 9:06am UTC](https://discuss.elastic.co/t/siem-event-correlation-rule-returns-no-data/291197 "2021-12-17T09:06:06Z")
Kibana version 7.14.1 I am creating an Event Correlation rule in SIEM and the preview does not return any results. If I do the same query in Dev Tools it works. I see that the preview runs some kind of java script but … --- ## [Detection rules for Log4J?s](https://discuss.elastic.co/t/detection-rules-for-log4j-s/292021)
**Author:** [@n2x4](https://discuss.elastic.co/u/n2x4)\ **Replies:** 3\ **Last updated:** [December 17, 2021, 7:46am UTC](https://discuss.elastic.co/t/detection-rules-for-log4j-s/292021 "2021-12-17T07:46:50Z")
Curious if anyone has rules in Elastic SIEM for log4j. I didn't see anything in the rule feed on Github and was wondering if there will be native rules for this. --- ## [Detecting Exploitation of CVE-2021-44228 (log4j2) with Elastic Security](https://discuss.elastic.co/t/detecting-exploitation-of-cve-2021-44228-log4j2-with-elastic-security/292138)
**Author:** [@jbal24](https://discuss.elastic.co/u/jbal24)\ **Replies:** 0\ **Last updated:** [December 16, 2021, 10:56am UTC](https://discuss.elastic.co/t/detecting-exploitation-of-cve-2021-44228-log4j2-with-elastic-security/292138 "2021-12-16T10:56:35Z")
Hi everyone, I would like to check with you one thing, we use our corporate Elastic as a SIEM using the security feature. We have seen this blog about: Detecting Exploitation of CVE-2021-44228 (log4j2) with Elastic Sec… --- ## [Elastic Agent - Should give me the option of updating to 7.16.0](https://discuss.elastic.co/t/elastic-agent-should-give-me-the-option-of-updating-to-7-16-0/291173)
**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Replies:** 5\ **Last updated:** [December 13, 2021, 2:29pm UTC](https://discuss.elastic.co/t/elastic-agent-should-give-me-the-option-of-updating-to-7-16-0/291173 "2021-12-13T14:29:08Z")
Any reasonings? --- ## [Zero-day-exploit in log4j2](https://discuss.elastic.co/t/zero-day-exploit-in-log4j2/291583)
**Author:** [@josh12](https://discuss.elastic.co/u/josh12)\ **Replies:** 0\ **Last updated:** [December 13, 2021, 4:30am UTC](https://discuss.elastic.co/t/zero-day-exploit-in-log4j2/291583 "2021-12-13T04:30:33Z")
Hi all, I'm bringing up my elastic stack via docker which consists of Elasticsearch, logstash and kibana. Is this sufficient or is there any other options needed to be performed. I'm using 7.15 version. What version are … --- ## [Log4j Critical Vulnerability](https://discuss.elastic.co/t/log4j-critical-vulnerability/291452)
**Author:** [@Chris\_Stone](https://discuss.elastic.co/u/Chris_Stone)\ **Replies:** 1\ **Last updated:** [December 10, 2021, 6:04pm UTC](https://discuss.elastic.co/t/log4j-critical-vulnerability/291452 "2021-12-10T18:04:28Z")
Are there any recommendations from Elastic regarding NVD - CVE-2021-44228), a very serious log4j vulnerability announced today? --- ## [Security Rules CPU load not balanced across hosts](https://discuss.elastic.co/t/security-rules-cpu-load-not-balanced-across-hosts/291393)
**Author:** [@heikis](https://discuss.elastic.co/u/heikis)\ **Replies:** 0\ **Last updated:** [December 10, 2021, 7:16am UTC](https://discuss.elastic.co/t/security-rules-cpu-load-not-balanced-across-hosts/291393 "2021-12-10T07:16:46Z")
Hello. I have an ES cluster consisting of 3 hosts and each host is running 8 datanodes + 1 master node, a total of 27 nodes (running as docker containers) plus one separate active master node as a VM in a separate networ… --- ## [Nothing under Security will load all of a sudden](https://discuss.elastic.co/t/nothing-under-security-will-load-all-of-a-sudden/287948)
**Author:** [@plaroche0](https://discuss.elastic.co/u/plaroche0)\ **Replies:** 10\ **Last updated:** [December 10, 2021, 12:50am UTC](https://discuss.elastic.co/t/nothing-under-security-will-load-all-of-a-sudden/287948 "2021-12-10T00:50:02Z")
All of a sudden nothing will load under the Security section of our Elastic instance. Everything else works fine. If I try to use anything under Security I just get the elastic logo. I have no idea where to begin troub… --- ## [Detection tab is not loading](https://discuss.elastic.co/t/detection-tab-is-not-loading/289440)
**Author:** [@aditi\_salunke](https://discuss.elastic.co/u/aditi_salunke)\ **Replies:** 1\ **Last updated:** [November 19, 2021, 1:09pm UTC](https://discuss.elastic.co/t/detection-tab-is-not-loading/289440 "2021-11-19T13:09:46Z")
Hello, I am utilizing detection feature on kibana 7.13.2 But many times detection tab is blank. After restarting kibana service , i am able to view detection tab. how should i solve this issue ? It is happening fre… [Previous page](https://discuss.elastic.co/c/security/83.md?page=36) [Next page](https://discuss.elastic.co/c/security/83.md?page=38)