# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=4 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 5 --- ## [USB Serial Number in file.Ext.device.serial\_number Always Zero or Random one digit Value](https://discuss.elastic.co/t/usb-serial-number-in-file-ext-device-serial-number-always-zero-or-random-one-digit-value/382051)
**Author:** [@alrolo3](https://discuss.elastic.co/u/alrolo3)\ **Replies:** 5\ **Last updated:** [September 18, 2025, 5:11pm UTC](https://discuss.elastic.co/t/usb-serial-number-in-file-ext-device-serial-number-always-zero-or-random-one-digit-value/382051 "2025-09-18T17:11:13Z")
Hello everyone, I’m opening this topic because I couldn’t find any solution or open issue related to this problem, either in GitHub or other forums. We are currently using Elastic Security as our SIEM, and one of our m… --- ## [Column width not resizable in Timelines](https://discuss.elastic.co/t/column-width-not-resizable-in-timelines/381510)
**Author:** [@RandomSOCAnalyst](https://discuss.elastic.co/u/RandomSOCAnalyst)\ **Replies:** 1\ **Last updated:** [September 8, 2025, 6:43am UTC](https://discuss.elastic.co/t/column-width-not-resizable-in-timelines/381510 "2025-09-08T06:43:01Z")
Hello everyone, we are running into an issue with Elastic SIEM / Security Module when it comes to investigating alerts using timelines. In many cases we would like to resize the column widths to our needs, to be able t… --- ## [Windows Security Toast Popup when updating Elastic Agent](https://discuss.elastic.co/t/windows-security-toast-popup-when-updating-elastic-agent/381431)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 4\ **Last updated:** [September 2, 2025, 2:48pm UTC](https://discuss.elastic.co/t/windows-security-toast-popup-when-updating-elastic-agent/381431 "2025-09-02T14:48:18Z")
Hello, Is there sth we can do to prevent this Windows Defender popu when updating an Elastic Agent with Defend integration? It’s just that it’s very confusing for end users. I’d like to keep Kind regards, Wille… --- ## [Elastic Endpoint in a degraded state](https://discuss.elastic.co/t/elastic-endpoint-in-a-degraded-state/381308)
**Author:** [@hairless\_mess](https://discuss.elastic.co/u/hairless_mess)\ **Replies:** 7\ **Last updated:** [September 1, 2025, 1:46pm UTC](https://discuss.elastic.co/t/elastic-endpoint-in-a-degraded-state/381308 "2025-09-01T13:46:31Z")
I have over 200 agents installed on mostly Linux hosts and some windows which work as intended. However, all my macos workstations have a problem with the Elastic Defend integration. After running the command sudo /Libra… --- ## [Manage Endpoint exceptions by group of enpoints](https://discuss.elastic.co/t/manage-endpoint-exceptions-by-group-of-enpoints/381304)
**Author:** [@sebem](https://discuss.elastic.co/u/sebem)\ **Replies:** 2\ **Last updated:** [August 26, 2025, 10:04am UTC](https://discuss.elastic.co/t/manage-endpoint-exceptions-by-group-of-enpoints/381304 "2025-08-26T10:04:32Z")
Hi, We are evaluating to deploy Elastic Defend EDR (8.19) in our environement with +10000 endpoints. And I've a question about exceptions/exclusions management in such a large environment. How do you manage exclusions… --- ## [Agent stuck sending documents over and over](https://discuss.elastic.co/t/agent-stuck-sending-documents-over-and-over/381030)
**Author:** [@michael-a](https://discuss.elastic.co/u/michael-a)\ **Replies:** 2\ **Last updated:** [August 20, 2025, 12:20pm UTC](https://discuss.elastic.co/t/agent-stuck-sending-documents-over-and-over/381030 "2025-08-20T12:20:20Z")
Not sure what this is, as far as I know it’s a first for us, but we have an agent on a LInux client that’s continously - 2 or 3 times per second - logging that it’s sending documents to Elasticsearch, the actual message … --- ## [Webhook from Elastic SIEM to Splunk SOAR not delivering alerts](https://discuss.elastic.co/t/webhook-from-elastic-siem-to-splunk-soar-not-delivering-alerts/381028)
**Author:** [@Rayleigh](https://discuss.elastic.co/u/Rayleigh)\ **Replies:** 1\ **Last updated:** [August 19, 2025, 12:34pm UTC](https://discuss.elastic.co/t/webhook-from-elastic-siem-to-splunk-soar-not-delivering-alerts/381028 "2025-08-19T12:34:22Z")
Hi, I’m trying to send alerts from Elastic SIEM to Splunk SOAR Cloud using a webhook connector. My detection rule is triggering fine — I can see multiple alerts in the Alerts list — but nothing is showing up in SOAR. C… --- ## [Missing md5 field in Harmony Email & Collaboration integration with Elastic](https://discuss.elastic.co/t/missing-md5-field-in-harmony-email-collaboration-integration-with-elastic/380401)
**Author:** [@jares](https://discuss.elastic.co/u/jares)\ **Replies:** 1\ **Last updated:** [August 19, 2025, 12:06am UTC](https://discuss.elastic.co/t/missing-md5-field-in-harmony-email-collaboration-integration-with-elastic/380401 "2025-08-19T00:06:48Z")
We are currently using the Checkpoint Harmony Email & Collaboration integration to forward logs to our ELK stack. However, we have noticed that the md5 field—which contains the hash values of email attachments—is missing… --- ## [Elastic Defend not recognized from Windows Server operating system](https://discuss.elastic.co/t/elastic-defend-not-recognized-from-windows-server-operating-system/380995)
**Author:** [@francesco.amato](https://discuss.elastic.co/u/francesco.amato)\ **Replies:** 3\ **Last updated:** [August 13, 2025, 3:46pm UTC](https://discuss.elastic.co/t/elastic-defend-not-recognized-from-windows-server-operating-system/380995 "2025-08-13T15:46:57Z")
Hello, we have encountered this problem On all Windows Server machines where we have installed the Elastic Agent with their Elastic Defend policy, Defend isn’t recognzed as antivirus software I searched on internet an… --- ## [Offline Decoding of EDR logs](https://discuss.elastic.co/t/offline-decoding-of-edr-logs/380934)
**Author:** [@Mash1](https://discuss.elastic.co/u/Mash1)\ **Replies:** 2\ **Last updated:** [August 12, 2025, 4:04pm UTC](https://discuss.elastic.co/t/offline-decoding-of-edr-logs/380934 "2025-08-12T16:04:02Z")
Hello, If an Elastic EDR agent is offline, not ingesting logs, while it is running autonomously, then we copy the log files ( such as documents-2025-MM-0DDT024007.log) out-of-band to an offline location while the agent … --- ## [Winlog.provider\_name not populated in 9.1.0](https://discuss.elastic.co/t/winlog-provider-name-not-populated-in-9-1-0/380623)
**Author:** [@syk](https://discuss.elastic.co/u/syk)\ **Replies:** 3\ **Last updated:** [August 12, 2025, 12:06pm UTC](https://discuss.elastic.co/t/winlog-provider-name-not-populated-in-9-1-0/380623 "2025-08-12T12:06:22Z")
Even with the System-Integration bugfix (Version 2.5.2) applied, data\_stream.dataset "system.security" and "system.system" don't deliver any data since the update from 9.0.4 to 9.1.0 yesterday: Important fields like … --- ## [Defend for Containers deprecation](https://discuss.elastic.co/t/defend-for-containers-deprecation/380875)
**Author:** [@Lexinga](https://discuss.elastic.co/u/Lexinga)\ **Replies:** 1\ **Last updated:** [August 8, 2025, 7:07am UTC](https://discuss.elastic.co/t/defend-for-containers-deprecation/380875 "2025-08-08T07:07:33Z")
I’m really frustrated with Elastic’s decision to deprecate Defend for Containers starting with Elastic Stack 9.0. Now, with no clear or feature-complete replacement, users are left scrambling to fill the gap. It’s a big … --- ## [How to protect elastic-agent service? (Anti-tampering protection)](https://discuss.elastic.co/t/how-to-protect-elastic-agent-service-anti-tampering-protection/380715)
**Author:** [@Hoang\_Hoang](https://discuss.elastic.co/u/Hoang_Hoang)\ **Replies:** 10\ **Last updated:** [August 6, 2025, 5:27pm UTC](https://discuss.elastic.co/t/how-to-protect-elastic-agent-service-anti-tampering-protection/380715 "2025-08-06T17:27:03Z")
Is there a way to prevent (using kernel-mode drivers) the administrator from stopping the elastic-agent service? I want to use Elastic-Agent combined with Elastic Defense for EDR, but the administrator can turn off the … --- ## [Elastic Defend - Causing Performance issue on Endpoints (Workplace)](https://discuss.elastic.co/t/elastic-defend-causing-performance-issue-on-endpoints-workplace/380609)
**Author:** [@Moulydharan\_Manivann](https://discuss.elastic.co/u/Moulydharan_Manivann)\ **Replies:** 2\ **Last updated:** [August 2, 2025, 7:54pm UTC](https://discuss.elastic.co/t/elastic-defend-causing-performance-issue-on-endpoints-workplace/380609 "2025-08-02T19:54:30Z")
Hello Everyone, We’re currently facing performance issues in our developer environments after deploying Elastic Agents. Environment Setup: Elasticsearch: On-prem deployment, version 8.18.1 Elastic Agent: ~15,000 agen… --- ## [The original document/raw event can't be found](https://discuss.elastic.co/t/the-original-document-raw-event-cant-be-found/380476)
**Author:** [@Sergie](https://discuss.elastic.co/u/Sergie)\ **Replies:** 3\ **Last updated:** [July 30, 2025, 5:58am UTC](https://discuss.elastic.co/t/the-original-document-raw-event-cant-be-found/380476 "2025-07-30T05:58:08Z")
I am seeing a similar situation as mentioned in this below post Little help understanding a document query issue: I have this default elastic security rule enabled i.e. High Number of Process and/or Service Termination.… --- ## [Fortigate not listed under "Network events" in Security](https://discuss.elastic.co/t/fortigate-not-listed-under-network-events-in-security/379754)
**Author:** [@dot-mike](https://discuss.elastic.co/u/dot-mike)\ **Replies:** 3\ **Last updated:** [July 24, 2025, 10:57am UTC](https://discuss.elastic.co/t/fortigate-not-listed-under-network-events-in-security/379754 "2025-07-24T10:57:16Z")
Hi, I'm wondering why Fortigate is not listed under the "Network events" pane in Security overview dashboard? Including screenshot for reference. Fortigate is an integration available to add, so I think it should be l… --- ## [Elastic and AlienVault OTX integration](https://discuss.elastic.co/t/elastic-and-alienvault-otx-integration/380376)
**Author:** [@Vishag\_Learning](https://discuss.elastic.co/u/Vishag_Learning)\ **Replies:** 1\ **Last updated:** [July 24, 2025, 5:20am UTC](https://discuss.elastic.co/t/elastic-and-alienvault-otx-integration/380376 "2025-07-24T05:20:47Z")
I'm integrating OTX TI with Elastic security. I used API from AlienVault OTX. BUt it asking for installing agent. Where to install it? How to proceed with it in right way ? Anyone Please help me with your insights on th… --- ## [Maximum Number of Cases Template on Elastic SIEM](https://discuss.elastic.co/t/maximum-number-of-cases-template-on-elastic-siem/380248)
**Author:** [@rusadirr](https://discuss.elastic.co/u/rusadirr)\ **Replies:** 2\ **Last updated:** [July 24, 2025, 3:52am UTC](https://discuss.elastic.co/t/maximum-number-of-cases-template-on-elastic-siem/380248 "2025-07-24T03:52:34Z")
On Security \> Cases \> Settings. I've reached the maximum number of templates (10 templates). This templates used to help case creation process more faster by auto-fill several input. Can I increase the maximum number of… --- ## [Is there a way to correlate FortiGate logs?](https://discuss.elastic.co/t/is-there-a-way-to-correlate-fortigate-logs/380143)
**Author:** [@meatwad](https://discuss.elastic.co/u/meatwad)\ **Replies:** 1\ **Last updated:** [July 20, 2025, 10:39pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-correlate-fortigate-logs/380143 "2025-07-20T22:39:00Z")
Hi there, I'm ingesting logs from our Fortinet FortiGate VPN server and was wondering if there's a way to correlate login sessions. The issue I'm trying to solve for is that the logs that show a successful login don't … --- ## [How to expose custom fields from alert JSON in the Slack API connector?](https://discuss.elastic.co/t/how-to-expose-custom-fields-from-alert-json-in-the-slack-api-connector/378142)
**Author:** [@iTiago](https://discuss.elastic.co/u/iTiago)\ **Replies:** 0\ **Last updated:** [May 14, 2025, 1:48pm UTC](https://discuss.elastic.co/t/how-to-expose-custom-fields-from-alert-json-in-the-slack-api-connector/378142 "2025-05-14T13:48:40Z")
Hello Team I'm implementing detection rules in Elastic Security (Kibana v8.x) and want to notify alerts in Slack using the Slack API connector. However, I can only use the predefined variables listed in the + Add variab… --- ## [Question about Agent versions and upgrades in Elastic Security Serverless](https://discuss.elastic.co/t/question-about-agent-versions-and-upgrades-in-elastic-security-serverless/380173)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [July 16, 2025, 11:41am UTC](https://discuss.elastic.co/t/question-about-agent-versions-and-upgrades-in-elastic-security-serverless/380173 "2025-07-16T11:41:49Z")
Hello, Just added a third agent in my Elastic Security serverless home setup and I noticed that this third Agent automatically updated to a version 9.0.3+build202507110136 which seems different then my other Agents whic… --- ## [MacOS agents are unhealthy due to Defend Endpoint](https://discuss.elastic.co/t/macos-agents-are-unhealthy-due-to-defend-endpoint/379616)
**Author:** [@hairless\_mess](https://discuss.elastic.co/u/hairless_mess)\ **Replies:** 12\ **Last updated:** [July 11, 2025, 7:38am UTC](https://discuss.elastic.co/t/macos-agents-are-unhealthy-due-to-defend-endpoint/379616 "2025-07-11T07:38:28Z")
Hello everyone, I have a problem with all my MacOS agents. As you can see below, the Agent itself was enrolled successfully and is sending logs, however, the Defend integration gives the error you see in the screenshot. … --- ## [Machine learning use case - Anomaly Detection](https://discuss.elastic.co/t/machine-learning-use-case-anomaly-detection/379237)
**Author:** [@sunith](https://discuss.elastic.co/u/sunith)\ **Replies:** 6\ **Last updated:** [July 10, 2025, 11:56am UTC](https://discuss.elastic.co/t/machine-learning-use-case-anomaly-detection/379237 "2025-07-10T11:56:54Z")
Hi Everyone, I'm currently developing and testing a Machine Learning-based use case in Elastic for anomaly detection. I've cloned and configured the ML job "auth\_rare\_hour\_for\_a\_user", which is designed to detect user l… --- ## [Can I send heartbeat data to Elastic Security Serverless?](https://discuss.elastic.co/t/can-i-send-heartbeat-data-to-elastic-security-serverless/379439)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 5\ **Last updated:** [July 8, 2025, 1:12pm UTC](https://discuss.elastic.co/t/can-i-send-heartbeat-data-to-elastic-security-serverless/379439 "2025-07-08T13:12:30Z")
Hello, So still playing with Elastic Security Serverless at home. Considering Security starts with asset management, I was hoping to monitor my home assets with Heartbeat and send the data to Elastic Security Serverless… --- ## [How to create a webhook](https://discuss.elastic.co/t/how-to-create-a-webhook/379698)
**Author:** [@KaWa](https://discuss.elastic.co/u/KaWa)\ **Replies:** 3\ **Last updated:** [July 4, 2025, 7:08am UTC](https://discuss.elastic.co/t/how-to-create-a-webhook/379698 "2025-07-04T07:08:08Z")
Dear community, TL;DR: goal: create tickets for SIEM alarms in ticket system path: use webhook with token (generated by ticket system) problem: how to setup a connector I'd like to create a ticket for every SIEM al… --- ## [Challenges Elastic Security for SIEM](https://discuss.elastic.co/t/challenges-elastic-security-for-siem/379577)
**Author:** [@Pabloj](https://discuss.elastic.co/u/Pabloj)\ **Replies:** 1\ **Last updated:** [June 28, 2025, 3:47am UTC](https://discuss.elastic.co/t/challenges-elastic-security-for-siem/379577 "2025-06-28T03:47:27Z")
I need assistance with starting the lab, as the Challenges section does not display the questions. Instead, it states that the instructor will provide the unlock code. However, I am taking the Elastic Security for SIEM (… --- ## [Failed install endpoint service: exit status 284](https://discuss.elastic.co/t/failed-install-endpoint-service-exit-status-284/379504)
**Author:** [@ArgoAdvisory](https://discuss.elastic.co/u/ArgoAdvisory)\ **Replies:** 4\ **Last updated:** [June 26, 2025, 3:28pm UTC](https://discuss.elastic.co/t/failed-install-endpoint-service-exit-status-284/379504 "2025-06-26T15:28:28Z")
Hello everyone, I am having this problem. I tried to uninstall Elastic Defend from a computer, but I can't... These are the things I tried: uninstall the agent: the agent is uninstalled successfully but the "Elastic… --- ## [Elastic SIEM & OpenCTI Integration](https://discuss.elastic.co/t/elastic-siem-opencti-integration/379082)
**Author:** [@Vishag\_Learning](https://discuss.elastic.co/u/Vishag_Learning)\ **Replies:** 12\ **Last updated:** [June 20, 2025, 10:25am UTC](https://discuss.elastic.co/t/elastic-siem-opencti-integration/379082 "2025-06-20T10:25:08Z")
Priority : High I’m currently working on integrating OpenCTI with Elastic SIEM. But when I look for documents, I get different guidance from OpenCTI and Elsatic(Providing both links below). I'm confused and stuck due to… --- ## [Alert response/action SLA support?](https://discuss.elastic.co/t/alert-response-action-sla-support/379333)
**Author:** [@taylor.callow](https://discuss.elastic.co/u/taylor.callow)\ **Replies:** 0\ **Last updated:** [June 19, 2025, 2:56pm UTC](https://discuss.elastic.co/t/alert-response-action-sla-support/379333 "2025-06-19T14:56:07Z")
Hey all, I cant see any built-in function to view/report on values like response time (e.g. time between alert being generated and time alert is set to acknowledged/closed). I can see that alerts appear to have a signa… --- ## [Multiple Alerts in Different ATT&CK Tactics on a Single Host](https://discuss.elastic.co/t/multiple-alerts-in-different-att-ck-tactics-on-a-single-host/379248)
**Author:** [@GKre](https://discuss.elastic.co/u/GKre)\ **Replies:** 3\ **Last updated:** [June 18, 2025, 10:56am UTC](https://discuss.elastic.co/t/multiple-alerts-in-different-att-ck-tactics-on-a-single-host/379248 "2025-06-18T10:56:56Z")
I wonder how to handle this kind of alert. Out of documentation i shall "investigate in timeline" to see what in detail triggered the alert. Well - my timeline is empty? Also in the alert data there's no more info abou… [Previous page](https://discuss.elastic.co/c/security/83.md?page=3) [Next page](https://discuss.elastic.co/c/security/83.md?page=5)