# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=38 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 39 --- ## [Duplicate events ingested by m365\_defender module](https://discuss.elastic.co/t/duplicate-events-ingested-by-m365-defender-module/290901)
**Author:** [@Foxboron](https://discuss.elastic.co/u/Foxboron)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 11:19pm UTC](https://discuss.elastic.co/t/duplicate-events-ingested-by-m365-defender-module/290901 "2021-12-09T23:19:13Z")
It seems like m365\_defender creates duplicate events. This seems to be because of non-stable ordering of the document fields. In our data it seems like fields inside the alert object changes their order and some of the f… --- ## [Kibana.alert.reason in actions](https://discuss.elastic.co/t/kibana-alert-reason-in-actions/290081)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 11:10pm UTC](https://discuss.elastic.co/t/kibana-alert-reason-in-actions/290081 "2021-12-09T23:10:50Z")
Is it possible to use kibana.alert.reason within the actions. I have tried {{#context.alerts}}{{kibana.alert.reason}}{{/context.alerts}} --- ## [Error activating rule (api key name is required)](https://discuss.elastic.co/t/error-activating-rule-api-key-name-is-required/291237)
**Author:** [@volundr](https://discuss.elastic.co/u/volundr)\ **Replies:** 8\ **Last updated:** [December 9, 2021, 4:22pm UTC](https://discuss.elastic.co/t/error-activating-rule-api-key-name-is-required/291237 "2021-12-09T16:22:56Z")
Hi, after following the official tutorial for enabling detection rules (Detections (beta) | SIEM Guide \[7.8\] | Elastic), I get the following error: \* \*\[action\_request\_validation\_exception\] Validation Failed: 1: api key … --- ## [Fleet Seperation of agents and policies](https://discuss.elastic.co/t/fleet-seperation-of-agents-and-policies/290292)
**Author:** [@Dea](https://discuss.elastic.co/u/Dea)\ **Replies:** 1\ **Last updated:** [December 8, 2021, 10:29pm UTC](https://discuss.elastic.co/t/fleet-seperation-of-agents-and-policies/290292 "2021-12-08T22:29:52Z")
Hi We would like to know how to separate agents and polices into different "Spaces/sites". At the moment we see all agents and policies in all spaces. Please advise Thank you --- ## [Elastic Agent Integration: File Integrity Monitoring (FIM)](https://discuss.elastic.co/t/elastic-agent-integration-file-integrity-monitoring-fim/290448)
**Author:** [@morgan.atwood](https://discuss.elastic.co/u/morgan.atwood)\ **Replies:** 3\ **Last updated:** [December 8, 2021, 3:10am UTC](https://discuss.elastic.co/t/elastic-agent-integration-file-integrity-monitoring-fim/290448 "2021-12-08T03:10:10Z")
Will the elastic agent/endpoint eventually have file integrity monitoring like Auditbeat in the future? Looking for options to replace TrendMicro but it looks like I'll have to use auditbeat or osquery with the elastic a… --- ## [Detection rules that only alert on the 1st detection of an event](https://discuss.elastic.co/t/detection-rules-that-only-alert-on-the-1st-detection-of-an-event/290933)
**Author:** [@kossde](https://discuss.elastic.co/u/kossde)\ **Replies:** 1\ **Last updated:** [December 7, 2021, 3:48pm UTC](https://discuss.elastic.co/t/detection-rules-that-only-alert-on-the-1st-detection-of-an-event/290933 "2021-12-07T15:48:21Z")
Apologies, but I am pretty new to the detection rules process. So any help is greatly appreciated! I was wondering if anyone knew of a way that I could create a detection rule that only alerts the first time an event o… --- ## [Integration: security\_detection\_engine-1](https://discuss.elastic.co/t/integration-security-detection-engine-1/291053)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 5\ **Last updated:** [December 6, 2021, 8:02pm UTC](https://discuss.elastic.co/t/integration-security-detection-engine-1/291053 "2021-12-06T20:02:45Z")
Is this needed? Elastic Endpoint seems to be working great without it, so I'm wondering why it's there and why should I assign is as an integration to my agents? --- ## [Specifications required](https://discuss.elastic.co/t/specifications-required/290778)
**Author:** [@Ajinkya\_Yadav](https://discuss.elastic.co/u/Ajinkya_Yadav)\ **Replies:** 1\ **Last updated:** [December 6, 2021, 2:01am UTC](https://discuss.elastic.co/t/specifications-required/290778 "2021-12-06T02:01:03Z")
Hello guys, I'm new to Elasticsearch, can anyone please tell me what are the minimum spec's for Elastic Endpoint? Thanks. --- ## [I need clear instruction to remove endpoint as it destruc my system](https://discuss.elastic.co/t/i-need-clear-instruction-to-remove-endpoint-as-it-destruc-my-system/290906)
**Author:** [@cthibault](https://discuss.elastic.co/u/cthibault)\ **Replies:** 2\ **Last updated:** [December 4, 2021, 6:31pm UTC](https://discuss.elastic.co/t/i-need-clear-instruction-to-remove-endpoint-as-it-destruc-my-system/290906 "2021-12-04T18:31:39Z")
ELK is destroing all the computer in my office by using all the drive space, all the RAM et all the bandwidth. I need to remove this scrap as soon as possible. HELP... --- ## [Osquery Manager Feedback](https://discuss.elastic.co/t/osquery-manager-feedback/290825)
**Author:** [@Aitor](https://discuss.elastic.co/u/Aitor)\ **Replies:** 2\ **Last updated:** [December 3, 2021, 6:09pm UTC](https://discuss.elastic.co/t/osquery-manager-feedback/290825 "2021-12-03T18:09:13Z")
Hi there, I have installed osquery manager and I am not able to do live queries from the fleet elastic cloud instance (v 7.15.2). I always get the message: "2 agents have responded, no osquery data has been reported" wh… --- ## [SIEM rule action: Send raw json \`context.alerts\` to webhook](https://discuss.elastic.co/t/siem-rule-action-send-raw-json-context-alerts-to-webhook/290698)
**Author:** [@peter6](https://discuss.elastic.co/u/peter6)\ **Replies:** 1\ **Last updated:** [December 3, 2021, 4:09pm UTC](https://discuss.elastic.co/t/siem-rule-action-send-raw-json-context-alerts-to-webhook/290698 "2021-12-03T16:09:13Z")
I'm trying to get the raw json content of context.alerts pushed to my webhook for further analysis. Something like {{#toJson}}\[{{context.alerts}}\]{{/toJson}} Received content is either empty or escaped \\". Please help… --- ## [SIEM rules advice](https://discuss.elastic.co/t/siem-rules-advice/290422)
**Author:** [@alaine](https://discuss.elastic.co/u/alaine)\ **Replies:** 4\ **Last updated:** [December 3, 2021, 8:20am UTC](https://discuss.elastic.co/t/siem-rules-advice/290422 "2021-12-03T08:20:57Z")
I am working on a team that is trying to use elastic as a SOC. We have all of the prebuilt SIEM rules within elastic, and someone enabled 80 of them at some point. Now we are going back through them to decide if we have … --- ## [SIEM custom rule to generate an alert if multiple users attempts with same source IP or same mac address](https://discuss.elastic.co/t/siem-custom-rule-to-generate-an-alert-if-multiple-users-attempts-with-same-source-ip-or-same-mac-address/289265)
**Author:** [@Priyanka\_chauhan](https://discuss.elastic.co/u/Priyanka_chauhan)\ **Replies:** 2\ **Last updated:** [December 2, 2021, 6:50am UTC](https://discuss.elastic.co/t/siem-custom-rule-to-generate-an-alert-if-multiple-users-attempts-with-same-source-ip-or-same-mac-address/289265 "2021-12-02T06:50:00Z")
I am trying to generate alerts using siem new rule if more than one user attempts with same source IP like vpn ip or vice versa ,so I want to know that It is possible or not via eql query or any kind of rule type If it i… --- ## [Can I modify either Winlogbeat or Filebeat to collect and send Alert and Audit data from McAfee EPO](https://discuss.elastic.co/t/can-i-modify-either-winlogbeat-or-filebeat-to-collect-and-send-alert-and-audit-data-from-mcafee-epo/290703)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 0\ **Last updated:** [December 1, 2021, 6:15pm UTC](https://discuss.elastic.co/t/can-i-modify-either-winlogbeat-or-filebeat-to-collect-and-send-alert-and-audit-data-from-mcafee-epo/290703 "2021-12-01T18:15:02Z")
I am looking for an efficient way to have my ELK stack SIEM pull Alert and Audit logs from my three ePO servers. Each ePO server will only be able to use UDP as the rest of the environment is locked down and they are in… --- ## [A security-enabled local group membership was enumerated -\> wbengine.exe](https://discuss.elastic.co/t/a-security-enabled-local-group-membership-was-enumerated-wbengine-exe/290550)
**Author:** [@Metro20357](https://discuss.elastic.co/u/Metro20357)\ **Replies:** 0\ **Last updated:** [November 30, 2021, 11:26am UTC](https://discuss.elastic.co/t/a-security-enabled-local-group-membership-was-enumerated-wbengine-exe/290550 "2021-11-30T11:26:53Z")
Hi all :slightly\_smiling\_face: I'm starting my adventure with Elstick and please be patient to Me :slight\_smile: I have such a case.I would like to know if there is anything to be afraid of :expressionless: I got the… --- ## [Row Renderers, not rendering?](https://discuss.elastic.co/t/row-renderers-not-rendering/290092)
**Author:** [@bm11100](https://discuss.elastic.co/u/bm11100)\ **Replies:** 2\ **Last updated:** [November 29, 2021, 9:48pm UTC](https://discuss.elastic.co/t/row-renderers-not-rendering/290092 "2021-11-29T21:48:49Z")
Hello, We have some Firewall data, that when viewed in the timeline, I'd expect the Flow row renderer to pick up and "beautify". I've attached a portion of the data for an example. Can someone explain why this would no… --- ## [Elastic SIEM. Security rules doesn't work](https://discuss.elastic.co/t/elastic-siem-security-rules-doesnt-work/290094)
**Author:** [@Dmitriy\_Esin](https://discuss.elastic.co/u/Dmitriy_Esin)\ **Replies:** 11\ **Last updated:** [November 29, 2021, 7:58pm UTC](https://discuss.elastic.co/t/elastic-siem-security-rules-doesnt-work/290094 "2021-11-29T19:58:38Z")
Hi all! I have an issue with the Elastic Security Rules. I've installed the elastic agents on my target instances: I can successfully see its data streams: I've created default enrolment policy for my agents: … --- ## [Elastic agent - Fleet x509: certificate signed by unknown authority](https://discuss.elastic.co/t/elastic-agent-fleet-x509-certificate-signed-by-unknown-authority/256330)
**Author:** [@111412](https://discuss.elastic.co/u/111412)\ **Replies:** 1\ **Last updated:** [October 4, 2021, 11:48am UTC](https://discuss.elastic.co/t/elastic-agent-fleet-x509-certificate-signed-by-unknown-authority/256330 "2021-10-04T11:48:12Z")
The error message is as follows :rofl: {"log.level":"error","@timestamp":"2020-11-23T15:59:58.735+0800","log.logger":"publisher\_pipeline\_output","log.origin":{"file.name":"pipeline/output.go","file.line":154},"message":… --- ## [Warning in Rules](https://discuss.elastic.co/t/warning-in-rules/290036)
**Author:** [@norgro2601](https://discuss.elastic.co/u/norgro2601)\ **Replies:** 3\ **Last updated:** [November 26, 2021, 8:21am UTC](https://discuss.elastic.co/t/warning-in-rules/290036 "2021-11-26T08:21:06Z")
Hi, I have an environment with several spaces to separate access to different indices, e.g. space a has only access to indices "filebeat-a-\*", space b to "filebeat-b-\*". In Security I've activated some of the provided … --- ## [Problems enabling security features](https://discuss.elastic.co/t/problems-enabling-security-features/290164)
**Author:** [@johnny1891](https://discuss.elastic.co/u/johnny1891)\ **Replies:** 2\ **Last updated:** [November 25, 2021, 4:04pm UTC](https://discuss.elastic.co/t/problems-enabling-security-features/290164 "2021-11-25T16:04:05Z")
Hi, I am trying to enable password so that I can create a super user to access some pages after enabling the EDR trial for 30 days in the license management page after setting up ELK stack. The reason is I got this err… --- ## [Complete DNS activity coverage in endpoint](https://discuss.elastic.co/t/complete-dns-activity-coverage-in-endpoint/288259)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 1\ **Last updated:** [November 23, 2021, 5:00pm UTC](https://discuss.elastic.co/t/complete-dns-activity-coverage-in-endpoint/288259 "2021-11-23T17:00:16Z")
Hey, I've noticed that the rule DNS Activity to the Internet does not work with Elastic Endpoint data, even when I explicitly contact an external DNS server from my machines that are covered by Elastic Endpoint. I dug … --- ## [Endgame not detecting malware](https://discuss.elastic.co/t/endgame-not-detecting-malware/289165)
**Author:** [@TimoG](https://discuss.elastic.co/u/TimoG)\ **Replies:** 7\ **Last updated:** [November 23, 2021, 9:25am UTC](https://discuss.elastic.co/t/endgame-not-detecting-malware/289165 "2021-11-23T09:25:24Z")
Hi, we are currently evaluating the Elastic Agent to be used as endpoint security solution within our company. We are especially interested in the features provided by Endgame. To get a feeling for the system I have se… --- ## [How far back in time does the Elastic Endpoint Security platform grab logs?](https://discuss.elastic.co/t/how-far-back-in-time-does-the-elastic-endpoint-security-platform-grab-logs/289447)
**Author:** [@geekzy](https://discuss.elastic.co/u/geekzy)\ **Replies:** 1\ **Last updated:** [November 22, 2021, 10:32pm UTC](https://discuss.elastic.co/t/how-far-back-in-time-does-the-elastic-endpoint-security-platform-grab-logs/289447 "2021-11-22T22:32:45Z")
We recently deployed elastic agent with endpoint security enabled across an environment and started seeing event logs from months prior to the agent being installed. This is brilliant from a visibility point of view, how… --- ## [Elastic SIEM Network Map Layers Issues](https://discuss.elastic.co/t/elastic-siem-network-map-layers-issues/289782)
**Author:** [@fmaginga](https://discuss.elastic.co/u/fmaginga)\ **Replies:** 0\ **Last updated:** [November 22, 2021, 8:14am UTC](https://discuss.elastic.co/t/elastic-siem-network-map-layers-issues/289782 "2021-11-22T08:14:41Z")
Hello, I have been experiencing some issues with Elastic SIEM Network Map Layers. I have configured only indices corporatepfw-ecs-\* from which the SIEM app collects events. See the image below. However, In the SIEM \>… --- ## [Automate update lists (threat intelligence)](https://discuss.elastic.co/t/automate-update-lists-threat-intelligence/288940)
**Author:** [@VellayLoket](https://discuss.elastic.co/u/VellayLoket)\ **Replies:** 1\ **Last updated:** [November 18, 2021, 11:18pm UTC](https://discuss.elastic.co/t/automate-update-lists-threat-intelligence/288940 "2021-11-18T23:18:11Z")
I have some lists which i use in some correlations. Ussually i update this lists manually. Is there some way to do this automatically? --- ## [Limit Case Visibility based on Tag](https://discuss.elastic.co/t/limit-case-visibility-based-on-tag/288671)
**Author:** [@bm11100](https://discuss.elastic.co/u/bm11100)\ **Replies:** 1\ **Last updated:** [November 18, 2021, 10:54am UTC](https://discuss.elastic.co/t/limit-case-visibility-based-on-tag/288671 "2021-11-18T10:54:05Z")
Hello, I don't want every user who has Read permissions in the Security app to be able to view the details of All cases. Is it possible to limit the visibility of Cases based on the Tag value? Thanks --- ## [Unable to see DNS queries though it shows count](https://discuss.elastic.co/t/unable-to-see-dns-queries-though-it-shows-count/289388)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 2\ **Last updated:** [November 18, 2021, 2:53am UTC](https://discuss.elastic.co/t/unable-to-see-dns-queries-though-it-shows-count/289388 "2021-11-18T02:53:54Z")
Hi Team, My elastic stack version is 7.15 and have windows AD which has DNS roles on it. I configured the SIEM APP and enrolled the server with elastic agent and fleet server. However in Security App/Kibana under Networ… --- ## [Detection Rule Export API not working](https://discuss.elastic.co/t/detection-rule-export-api-not-working/287548)
**Author:** [@tejas.tech](https://discuss.elastic.co/u/tejas.tech)\ **Replies:** 2\ **Last updated:** [November 18, 2021, 12:44am UTC](https://discuss.elastic.co/t/detection-rule-export-api-not-working/287548 "2021-11-18T00:44:23Z")
I would like to export all detection rule with details, and I did check with "Kibana IP: port/api/detection\_engine/rules/\_export", when I check with this I am getting 404 error with not found. Could anyone please help … --- ## [File Integrity Monitoring for Windows Using Elastic Agent](https://discuss.elastic.co/t/file-integrity-monitoring-for-windows-using-elastic-agent/289476)
**Author:** [@afarley](https://discuss.elastic.co/u/afarley)\ **Replies:** 0\ **Last updated:** [November 17, 2021, 3:46pm UTC](https://discuss.elastic.co/t/file-integrity-monitoring-for-windows-using-elastic-agent/289476 "2021-11-17T15:46:35Z")
Hello all, I have been looking into how to implement Elastic Security most effectively to meet PCI requirements and a snag I've run into with other tools is successfully implementing FIM in a Windows environment. I am n… --- ## [Anyone have success using Machine Learning to detect Fast or Impossible Travel?](https://discuss.elastic.co/t/anyone-have-success-using-machine-learning-to-detect-fast-or-impossible-travel/288822)
**Author:** [@obsidian](https://discuss.elastic.co/u/obsidian)\ **Replies:** 6\ **Last updated:** [November 16, 2021, 10:43am UTC](https://discuss.elastic.co/t/anyone-have-success-using-machine-learning-to-detect-fast-or-impossible-travel/288822 "2021-11-16T10:43:48Z")
So far I've seen a built-in job called rare source ip for user, however, it is using auditbeat. Is there a way to detect rare source ips for a user using a different datasource? [Previous page](https://discuss.elastic.co/c/security/83.md?page=37) [Next page](https://discuss.elastic.co/c/security/83.md?page=39)