# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=39 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 40 --- ## [Elastic Security Deployment for an MSSP](https://discuss.elastic.co/t/elastic-security-deployment-for-an-mssp/289085)
**Author:** [@afarley](https://discuss.elastic.co/u/afarley)\ **Replies:** 6\ **Last updated:** [November 15, 2021, 6:29pm UTC](https://discuss.elastic.co/t/elastic-security-deployment-for-an-mssp/289085 "2021-11-15T18:29:40Z")
Hello all, I am a security engineer for an MSSP and am currently having issues understanding how to best deploy Elastic Security for our multi-tenant environment. I've heard talk of isolating indexes by client and using… --- ## [Can I use my own Threat Intel stored in plain txt file using filebeat module?](https://discuss.elastic.co/t/can-i-use-my-own-threat-intel-stored-in-plain-txt-file-using-filebeat-module/286911)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 6\ **Last updated:** [November 12, 2021, 3:16am UTC](https://discuss.elastic.co/t/can-i-use-my-own-threat-intel-stored-in-plain-txt-file-using-filebeat-module/286911 "2021-11-12T03:16:58Z")
Hi, I have elastic SIEM 7.15 and have enabled threat intel filebeat module; it works very well however wondering if I can use my own threat intel gathered and stored in plain txt file? This comprises of IP Addresses, do… --- ## [Webhook body format for threshold term value](https://discuss.elastic.co/t/webhook-body-format-for-threshold-term-value/287894)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 6\ **Last updated:** [November 10, 2021, 6:59pm UTC](https://discuss.elastic.co/t/webhook-body-format-for-threshold-term-value/287894 "2021-11-10T18:59:55Z")
Hi all. I've just created a webhooks to an internal services that will need to get the value as the result of the signal that a siem threshold rule will produce. Normally for email connector the body will look like thi… --- ## [Feedback for 100Gbit/s Elastic SIEM design (which includes Suricata)](https://discuss.elastic.co/t/feedback-for-100gbit-s-elastic-siem-design-which-includes-suricata/288724)
**Author:** [@UPPERCASE](https://discuss.elastic.co/u/UPPERCASE)\ **Replies:** 0\ **Last updated:** [November 9, 2021, 8:43am UTC](https://discuss.elastic.co/t/feedback-for-100gbit-s-elastic-siem-design-which-includes-suricata/288724 "2021-11-09T08:43:01Z")
Is cross-posting allowed here? If so, then I would like to hear some feedback on the topic below. You may reply on this Discourse instance, or the Suricata one of course. --- ## [Do not recieve sysmon log from the Windows Integration in elastic agent](https://discuss.elastic.co/t/do-not-recieve-sysmon-log-from-the-windows-integration-in-elastic-agent/288362)
**Author:** [@RobinIT](https://discuss.elastic.co/u/RobinIT)\ **Replies:** 7\ **Last updated:** [November 8, 2021, 7:57am UTC](https://discuss.elastic.co/t/do-not-recieve-sysmon-log-from-the-windows-integration-in-elastic-agent/288362 "2021-11-08T07:57:34Z")
Hello, I want to enable in elastic agent the Windows integration (version 1.2.2) I want to use this integration to ship in Sysmon and powershell log. The agent is connected to a Fleet. Adding the integration to the age… --- ## [SIEM network map states "Error loading map features" at all end points](https://discuss.elastic.co/t/siem-network-map-states-error-loading-map-features-at-all-end-points/288503)
**Author:** [@teamomni](https://discuss.elastic.co/u/teamomni)\ **Replies:** 0\ **Last updated:** [November 5, 2021, 2:33pm UTC](https://discuss.elastic.co/t/siem-network-map-states-error-loading-map-features-at-all-end-points/288503 "2021-11-05T14:33:47Z")
We currently are using Logstash to export all of our source, destination, and connection data from our network to our cloud, but the map states "Error loading map features" on all end points. All end points collected fr… --- ## [Set custom event.category field to execute EQL in detection rules](https://discuss.elastic.co/t/set-custom-event-category-field-to-execute-eql-in-detection-rules/287986)
**Author:** [@Silver137](https://discuss.elastic.co/u/Silver137)\ **Replies:** 1\ **Last updated:** [November 5, 2021, 10:47am UTC](https://discuss.elastic.co/t/set-custom-event-category-field-to-execute-eql-in-detection-rules/287986 "2021-11-05T10:47:32Z")
I'm trying to set up a custom detection rule based in EQL sequence matching, with the trouble that the field that I chose for custom event.category in ECS It's really the ECS tags field in my indexed documents I'm in th… --- ## [Fields missing in EQL sequence detection rule with building block alert as source](https://discuss.elastic.co/t/fields-missing-in-eql-sequence-detection-rule-with-building-block-alert-as-source/288483)
**Author:** [@masual](https://discuss.elastic.co/u/masual)\ **Replies:** 0\ **Last updated:** [November 5, 2021, 10:05am UTC](https://discuss.elastic.co/t/fields-missing-in-eql-sequence-detection-rule-with-building-block-alert-as-source/288483 "2021-11-05T10:05:41Z")
Hi everyone, I am implementing a set of Detection Rules to correlate events from different sources. I created a Threshold Rule and marked it as "building block" since I plan to use the alerts it generates as the source… --- ## [Group identical alerts in Elastic Security \[7.14.2\]](https://discuss.elastic.co/t/group-identical-alerts-in-elastic-security-7-14-2/288424)
**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\ **Replies:** 0\ **Last updated:** [November 4, 2021, 3:00pm UTC](https://discuss.elastic.co/t/group-identical-alerts-in-elastic-security-7-14-2/288424 "2021-11-04T15:00:47Z")
Hi, everyone I would like to know whether it is possible to group several occurrences of same alerts in Elastic Security. For instance, we have configured a detection rule which has generated many alerts in a short per… --- ## [Agent "Unhealthy". "Error while dialing open \\\\\\.\\\\pipe\\\\elastic-agent-\[...\]"](https://discuss.elastic.co/t/agent-unhealthy-error-while-dialing-open-pipe-elastic-agent/285814)
**Author:** [@maof97](https://discuss.elastic.co/u/maof97)\ **Replies:** 9\ **Last updated:** [November 4, 2021, 9:30pm UTC](https://discuss.elastic.co/t/agent-unhealthy-error-while-dialing-open-pipe-elastic-agent/285814 "2021-11-04T21:30:51Z")
I've upgraded ELK to 7.15 and had some errors starting up Kibana so I made the mistake to delete the .kibana index (someone wrote it somewhere). So at the end I had to basically set up everything new. Now I have also up… --- ## [Detection Engine does not create Signals anymore](https://discuss.elastic.co/t/detection-engine-does-not-create-signals-anymore/288370)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 0\ **Last updated:** [November 3, 2021, 9:10pm UTC](https://discuss.elastic.co/t/detection-engine-does-not-create-signals-anymore/288370 "2021-11-03T21:10:42Z")
Hey, around the end of october, my alerting rules stopped working. I'm looking at the rule DNS activity to the Internet as my prime example, since this was triggering fairly regularly back when Detection Engine was … --- ## [Json in alert result (message)](https://discuss.elastic.co/t/json-in-alert-result-message/288145)
**Author:** [@Alexey\_Shalin](https://discuss.elastic.co/u/Alexey_Shalin)\ **Replies:** 0\ **Last updated:** [November 1, 2021, 2:01pm UTC](https://discuss.elastic.co/t/json-in-alert-result-message/288145 "2021-11-01T14:01:55Z")
Good Day I have alerts in SIEM based on built-in rules. In Action Tab for Rule I setuped : Send Alert to Email and using this : {{#context.alerts}} Username: {{user.name}} Host: {{host.name}} {{/context.alerts}} Ev… --- ## [Security rules failing (timed out) all the time](https://discuss.elastic.co/t/security-rules-failing-timed-out-all-the-time/285681)
**Author:** [@syunusic](https://discuss.elastic.co/u/syunusic)\ **Replies:** 5\ **Last updated:** [November 1, 2021, 4:05pm UTC](https://discuss.elastic.co/t/security-rules-failing-timed-out-all-the-time/285681 "2021-11-01T16:05:27Z")
I have a testing Elasticsearch (7.14.0 before and 7.15.0 now) where I'm sending filebeat's Threat Intel data (50,000 documents on the filebeat-\* index) and a Firewall data index with less than 1,000,000 messages. I've c… --- ## [Endpoint SIEM rule trigger execution "email"](https://discuss.elastic.co/t/endpoint-siem-rule-trigger-execution-email/287836)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 3\ **Last updated:** [November 1, 2021, 4:04pm UTC](https://discuss.elastic.co/t/endpoint-siem-rule-trigger-execution-email/287836 "2021-11-01T16:04:30Z")
Simple idea and question for this one. SIEM rules are really nice but I'll be honest I don't keep the Alerts tabs open 24x7. I do have to sleep at some point in life... Setting the Endpoint Security rule to perform a ta… --- ## [Set Elastic Security rules on syslog](https://discuss.elastic.co/t/set-elastic-security-rules-on-syslog/288012)
**Author:** [@Limoelou](https://discuss.elastic.co/u/Limoelou)\ **Replies:** 2\ **Last updated:** [November 1, 2021, 11:01am UTC](https://discuss.elastic.co/t/set-elastic-security-rules-on-syslog/288012 "2021-11-01T11:01:33Z")
Hello, I'm having trouble to display syslog events in Kibana. I have a Stormshield firewall sending syslog events to my elastic server from different hosts : 2628 2703 3.429885364 192.168.3.223 → 10.22.5.58 Syslog … --- ## [Rename exported rules to their original name](https://discuss.elastic.co/t/rename-exported-rules-to-their-original-name/287722)
**Author:** [@michel.beaudry](https://discuss.elastic.co/u/michel.beaudry)\ **Replies:** 1\ **Last updated:** [November 1, 2021, 10:44am UTC](https://discuss.elastic.co/t/rename-exported-rules-to-their-original-name/287722 "2021-11-01T10:44:12Z")
Exporting a rule in Elastic Security always result in a file named rules\_export.ndjson It would make much more sense to use the rule name as the title for the exported rule, is there any parameters to set this or it has… --- ## [How to track cases in a dashboard?](https://discuss.elastic.co/t/how-to-track-cases-in-a-dashboard/287259)
**Author:** [@elasticfran](https://discuss.elastic.co/u/elasticfran)\ **Replies:** 1\ **Last updated:** [November 1, 2021, 10:36am UTC](https://discuss.elastic.co/t/how-to-track-cases-in-a-dashboard/287259 "2021-11-01T10:36:49Z")
Hello there! Is there a way to track cases in a dashboard? Like having a panel for: open cases cases in progress pending cases new cases Tried the tutorial: but i happen not to have the option "add a les" visuali… --- ## [Rule hits visible in preview, but no alerts triggered](https://discuss.elastic.co/t/rule-hits-visible-in-preview-but-no-alerts-triggered/287457)
**Author:** [@mcreedjr](https://discuss.elastic.co/u/mcreedjr)\ **Replies:** 4\ **Last updated:** [October 27, 2021, 4:10pm UTC](https://discuss.elastic.co/t/rule-hits-visible-in-preview-but-no-alerts-triggered/287457 "2021-10-27T16:10:02Z")
I've imported the default Elastic rules, and duplicated the 'whoami' rule. When I preview the rule, it shows hits, but there are no alerts raised. I feel that I'm missing something super obvious, but I would expect to se… --- ## [Elasticsearch SIEM is not working, but EQL query is ok](https://discuss.elastic.co/t/elasticsearch-siem-is-not-working-but-eql-query-is-ok/287590)
**Author:** [@Dalador](https://discuss.elastic.co/u/Dalador)\ **Replies:** 1\ **Last updated:** [October 29, 2021, 1:54pm UTC](https://discuss.elastic.co/t/elasticsearch-siem-is-not-working-but-eql-query-is-ok/287590 "2021-10-29T13:54:11Z")
I got some problems with my ELK running on docker. I made ssl on tls and http and tryied to make simple EQL-query: sequence by winlog.computer\_name \[iam where event.code == "4720"\] \[iam where event.code == "4726"\] Wh… --- ## [Security error after re-install of ElasticSearch](https://discuss.elastic.co/t/security-error-after-re-install-of-elasticsearch/287593)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 4\ **Last updated:** [October 27, 2021, 12:16pm UTC](https://discuss.elastic.co/t/security-error-after-re-install-of-elasticsearch/287593 "2021-10-27T12:16:37Z")
Good Morning I have been receiving multiple messages that read Error: \[object Object\]: shard\_not\_found\_exception at http://10.12.36.50:5601/41022/bundles/plugin/data/kibana/data.plugin.js:1:361224 at async index… --- ## [Suricata integration parsing issues](https://discuss.elastic.co/t/suricata-integration-parsing-issues/284954)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 3\ **Last updated:** [October 27, 2021, 2:02am UTC](https://discuss.elastic.co/t/suricata-integration-parsing-issues/284954 "2021-10-27T02:02:07Z")
I'm running 7.14.1 with an Elastic agent trying to pick up eve.json files using the suricata integration. Somewhere along the line it is not able to correctly parse the events. Here is the error I'm getting : {\\"type\\… --- ## [Kibana webhook for firewall blacklist update](https://discuss.elastic.co/t/kibana-webhook-for-firewall-blacklist-update/286815)
**Author:** [@algira37](https://discuss.elastic.co/u/algira37)\ **Replies:** 5\ **Last updated:** [October 26, 2021, 5:34pm UTC](https://discuss.elastic.co/t/kibana-webhook-for-firewall-blacklist-update/286815 "2021-10-26T17:34:10Z")
Hello, I would like to use Kibana with the webhook feature to call my microservice to update my firewall blacklist. Unfortunately, I cant find that this feature is free or not, could you please help me? --- ## [Detector field "beat.hostname" is not an aggregatable field](https://discuss.elastic.co/t/detector-field-beat-hostname-is-not-an-aggregatable-field/287212)
**Author:** [@Mark3](https://discuss.elastic.co/u/Mark3)\ **Replies:** 1\ **Last updated:** [October 26, 2021, 11:00am UTC](https://discuss.elastic.co/t/detector-field-beat-hostname-is-not-an-aggregatable-field/287212 "2021-10-26T11:00:47Z")
Following the instructions for the DETECT DNS DATA EXFILTRATION lab, I hit this wall, any ideas? Cheers, Mark --- ## [SIEM Detection Alert during kibana downtime](https://discuss.elastic.co/t/siem-detection-alert-during-kibana-downtime/286007)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 0\ **Last updated:** [October 6, 2021, 10:19am UTC](https://discuss.elastic.co/t/siem-detection-alert-during-kibana-downtime/286007 "2021-10-06T10:19:16Z")
Hi, Is there any work around to overcome the missing detection alert during the kibana downtime if its more than the alert loobback time? Thanks --- ## [ELK set up for creating a SIEM Solution\_Upwork Request](https://discuss.elastic.co/t/elk-set-up-for-creating-a-siem-solution-upwork-request/286299)
**Author:** [@Codedestiny1](https://discuss.elastic.co/u/Codedestiny1)\ **Replies:** 2\ **Last updated:** [October 25, 2021, 2:09pm UTC](https://discuss.elastic.co/t/elk-set-up-for-creating-a-siem-solution-upwork-request/286299 "2021-10-25T14:09:12Z")
Hi everyone, I have previously set up an ELK server using Microsoft Azure (I'm open to doing it on AWS). Is anyone available on Upwork to be hired to architect and set up scripts (using ansible playbook or other docker c… --- ## [Mac Login logging (and general Elastic Security questions)](https://discuss.elastic.co/t/mac-login-logging-and-general-elastic-security-questions/287503)
**Author:** [@K\_Birt](https://discuss.elastic.co/u/K_Birt)\ **Replies:** 0\ **Last updated:** [October 23, 2021, 8:57pm UTC](https://discuss.elastic.co/t/mac-login-logging-and-general-elastic-security-questions/287503 "2021-10-23T20:57:32Z")
Hello! I have been tasked with creating an SIEM for my company. First off, the header for this section is "Integrate free and open SIEM, and endpoint, to prevent, detect, and respond to threats" (I added the emphasis o… --- ## [Elastic Endpoint - Filebeat - Java Error](https://discuss.elastic.co/t/elastic-endpoint-filebeat-java-error/282676)
**Author:** [@mikemitchell](https://discuss.elastic.co/u/mikemitchell)\ **Replies:** 7\ **Last updated:** [October 22, 2021, 5:28pm UTC](https://discuss.elastic.co/t/elastic-endpoint-filebeat-java-error/282676 "2021-10-22T17:28:07Z")
I'm receiving an error message on all of my endpoints utilizing the filebeat agent spawned by the System integration for Windows. I was wondering if it is based on the Java installation of my windows machines or the file… --- ## [Rules failing due to field mapping errors](https://discuss.elastic.co/t/rules-failing-due-to-field-mapping-errors/286981)
**Author:** [@PD98](https://discuss.elastic.co/u/PD98)\ **Replies:** 1\ **Last updated:** [October 22, 2021, 3:49am UTC](https://discuss.elastic.co/t/rules-failing-due-to-field-mapping-errors/286981 "2021-10-22T03:49:17Z")
Hi, I have enabled elastic security and activated the rules. I am using auditbeat to collect audit data and send it to logstash which then indexes it in elasticsearch. I am not performing any mutation on the logs via lo… --- ## [Detection Alerts only show documents from .siem-signals-default index](https://discuss.elastic.co/t/detection-alerts-only-show-documents-from-siem-signals-default-index/287338)
**Author:** [@michel.beaudry](https://discuss.elastic.co/u/michel.beaudry)\ **Replies:** 0\ **Last updated:** [October 21, 2021, 4:54pm UTC](https://discuss.elastic.co/t/detection-alerts-only-show-documents-from-siem-signals-default-index/287338 "2021-10-21T16:54:32Z")
In Kibana-\>Security-\>Detections the Trend panel only show alerts from .siem-signals-default index. Upon clicking on Inspect it shows following: Furthermore, clicking on the (i) next to index pattern says that the pat… --- ## [Matching rule with indicator match error parsing date field](https://discuss.elastic.co/t/matching-rule-with-indicator-match-error-parsing-date-field/287171)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 3\ **Last updated:** [October 21, 2021, 3:16pm UTC](https://discuss.elastic.co/t/matching-rule-with-indicator-match-error-parsing-date-field/287171 "2021-10-21T15:16:01Z")
I create a index that contain all domain that i want to query to according to ecs. Now i create a rule that will match any domain query from dns index but it give me this errror: An error occurred during rule execution… [Previous page](https://discuss.elastic.co/c/security/83.md?page=38) [Next page](https://discuss.elastic.co/c/security/83.md?page=40)