# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=40 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 41 --- ## [Second issue trying to change the elastic-agent grpc.port during fleet server 7.15 setup](https://discuss.elastic.co/t/second-issue-trying-to-change-the-elastic-agent-grpc-port-during-fleet-server-7-15-setup/286903)
**Author:** [@rrivers](https://discuss.elastic.co/u/rrivers)\ **Replies:** 2\ **Last updated:** [October 20, 2021, 11:32am UTC](https://discuss.elastic.co/t/second-issue-trying-to-change-the-elastic-agent-grpc-port-during-fleet-server-7-15-setup/286903 "2021-10-20T11:32:31Z")
I'm running into a second issue trying to install fleet server 7.15 on an Ubuntu 20.04 machine because of a port conflict since 127.0.0.1:6789 is already in use by another application. The fix to the first post allowed t… --- ## [Security Detection Rules Cause: \`circuit\_breaking\_exception\` on medium-ish deployments](https://discuss.elastic.co/t/security-detection-rules-cause-circuit-breaking-exception-on-medium-ish-deployments/286654)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 6\ **Last updated:** [October 19, 2021, 12:51pm UTC](https://discuss.elastic.co/t/security-detection-rules-cause-circuit-breaking-exception-on-medium-ish-deployments/286654 "2021-10-19T12:51:53Z")
Hi All, I noticed that a few detection rules consume a lot of memory, and cause circuit\_breaking\_exception often in medium-ish deployments (~265 winlogbeat deployments). Elasticsearch version: 7.14.1 Offending Rules: … --- ## [Elastic Endgame Sensor](https://discuss.elastic.co/t/elastic-endgame-sensor/286933)
**Author:** [@marisa.david](https://discuss.elastic.co/u/marisa.david)\ **Replies:** 5\ **Last updated:** [October 19, 2021, 1:28am UTC](https://discuss.elastic.co/t/elastic-endgame-sensor/286933 "2021-10-19T01:28:19Z")
I have been attempting to deploy a sensor but every time I try to in the command prompt it says it cannot be found. I am not sure if I am putting the information in wrong. --- ## [EQL query help](https://discuss.elastic.co/t/eql-query-help/286974)
**Author:** [@Billz1026](https://discuss.elastic.co/u/Billz1026)\ **Replies:** 0\ **Last updated:** [October 18, 2021, 10:35am UTC](https://discuss.elastic.co/t/eql-query-help/286974 "2021-10-18T10:35:46Z")
Hi All, I am using EQL to write detection rues. I have a sequence of evens as follows. Event A Event B Event C I want to raise an alert if the time between Event A and Event C exceeds 30 seconds. I tried with maxspa… --- ## [Host isolation](https://discuss.elastic.co/t/host-isolation/286745)
**Author:** [@wmacleodstrath](https://discuss.elastic.co/u/wmacleodstrath)\ **Replies:** 7\ **Last updated:** [October 18, 2021, 8:12am UTC](https://discuss.elastic.co/t/host-isolation/286745 "2021-10-18T08:12:09Z")
7.14 - when I go to a case, with an alert on it , and click to get the fly out, I'm not seeing an option to "Take Action" and isolate a host. Do you only see the "Take Action" button if there is a certain alert in the ca… --- ## ["Isolate Host" is missing](https://discuss.elastic.co/t/isolate-host-is-missing/286843)
**Author:** [@robert.gleaden](https://discuss.elastic.co/u/robert.gleaden)\ **Replies:** 3\ **Last updated:** [October 18, 2021, 8:04am UTC](https://discuss.elastic.co/t/isolate-host-is-missing/286843 "2021-10-18T08:04:25Z")
Hi All, I have recently installed an ELK stack on Debian 11 v7.150.0 and seem to be having one issue, I've added the "Security Endpoint" as an integration however there is no "Isolate Agent" option under the "Take Actio… --- ## [How do I get the dns.request.registerd\_name field?](https://discuss.elastic.co/t/how-do-i-get-the-dns-request-registerd-name-field/286883)
**Author:** [@polarfox](https://discuss.elastic.co/u/polarfox)\ **Replies:** 5\ **Last updated:** [October 17, 2021, 9:10am UTC](https://discuss.elastic.co/t/how-do-i-get-the-dns-request-registerd-name-field/286883 "2021-10-17T09:10:14Z")
Hello all, I've recently started getting familiar with Elastic Security. I'm currently using the 14-day free trial and I have a very small setup with a single Windows 10 machine enrolled as an agent. When I click on Se… --- ## [Threat Intel filebeat module](https://discuss.elastic.co/t/threat-intel-filebeat-module/283979)
**Author:** [@SiRVaNdO](https://discuss.elastic.co/u/SiRVaNdO)\ **Replies:** 9\ **Last updated:** [October 15, 2021, 10:50am UTC](https://discuss.elastic.co/t/threat-intel-filebeat-module/283979 "2021-10-15T10:50:08Z")
Hello everyone, I installed a filebeat with the threat intel module and it's importing threat intel data to the Elasticsearch. When I visit the feeds dashboards all is working properly. The problem comes when I tried t… --- ## [Detection Engine Workflow](https://discuss.elastic.co/t/detection-engine-workflow/286725)
**Author:** [@poojamehta\_ids](https://discuss.elastic.co/u/poojamehta_ids)\ **Replies:** 0\ **Last updated:** [October 14, 2021, 1:05pm UTC](https://discuss.elastic.co/t/detection-engine-workflow/286725 "2021-10-14T13:05:33Z")
How can I get to know more about detection engine workflow? How are the detection rules executed? Are there any resources available to understand its workflow as well as code? --- ## [Can't enroll MacOS agent](https://discuss.elastic.co/t/cant-enroll-macos-agent/283601)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 11\ **Last updated:** [October 13, 2021, 9:05pm UTC](https://discuss.elastic.co/t/cant-enroll-macos-agent/283601 "2021-10-13T21:05:38Z")
Me again..I'm trying to enroll a macOS agent and when I run the enroll command I get the following : Error: fail to enroll: fail to execute request to fleet-server: fail to decode enrollment response: context canceled E… --- ## [FireEye HX for Endpoint protection Vs Elastic endpoint security](https://discuss.elastic.co/t/fireeye-hx-for-endpoint-protection-vs-elastic-endpoint-security/285784)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 1\ **Last updated:** [October 13, 2021, 6:36pm UTC](https://discuss.elastic.co/t/fireeye-hx-for-endpoint-protection-vs-elastic-endpoint-security/285784 "2021-10-13T18:36:55Z")
Do we have the comparison details of FireEye HX for Endpoint protection Vs Elastic endpoint security opensource? --- ## [How do I troubleshoot elastic agent not sending any logs to siem app](https://discuss.elastic.co/t/how-do-i-troubleshoot-elastic-agent-not-sending-any-logs-to-siem-app/286311)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 5\ **Last updated:** [October 12, 2021, 11:39am UTC](https://discuss.elastic.co/t/how-do-i-troubleshoot-elastic-agent-not-sending-any-logs-to-siem-app/286311 "2021-10-12T11:39:55Z")
Hi Team, I have enrolled windows serves through fleet and installed elastic-agent on them with malware-protction enabled in detect mode. However not a single log is being shipped hence wondering how do I troubleshoot th… --- ## [Track Application-level Events?](https://discuss.elastic.co/t/track-application-level-events/286419)
**Author:** [@dekim](https://discuss.elastic.co/u/dekim)\ **Replies:** 1\ **Last updated:** [October 12, 2021, 1:49am UTC](https://discuss.elastic.co/t/track-application-level-events/286419 "2021-10-12T01:49:47Z")
We currently have a set of microservice. We would like to log all HTTP Requests using the Elastic Common Schema (ECS). Since Elastic propose a SIEM (known as Elastic SIEM), would it make sense to display these data in … --- ## [Unable to change the elastic-agent grpc.port during fleet server setup](https://discuss.elastic.co/t/unable-to-change-the-elastic-agent-grpc-port-during-fleet-server-setup/286314)
**Author:** [@rrivers](https://discuss.elastic.co/u/rrivers)\ **Replies:** 2\ **Last updated:** [October 11, 2021, 2:19pm UTC](https://discuss.elastic.co/t/unable-to-change-the-elastic-agent-grpc-port-during-fleet-server-setup/286314 "2021-10-11T14:19:46Z")
I'm trying to install fleet server 7.15 on an Ubuntu 20.04 machine but I'm running into a port conflict since 127.0.0.1:6789 is already in use by another application. I found a post that suggested running ./elastic-age… --- ## [Failed to retrieve password hash for reserved user \[elastic\]](https://discuss.elastic.co/t/failed-to-retrieve-password-hash-for-reserved-user-elastic/286255)
**Author:** [@rachelyang](https://discuss.elastic.co/u/rachelyang)\ **Replies:** 1\ **Last updated:** [October 10, 2021, 10:43pm UTC](https://discuss.elastic.co/t/failed-to-retrieve-password-hash-for-reserved-user-elastic/286255 "2021-10-10T22:43:06Z")
I have verified the password of user elastic. curl -k -u elastic 'https://localhost:9200/\_xpack/security/\_authenticate?pretty' Enter host password for user 'elastic': { "username" : "elastic", "roles" : \[ "supe… --- ## [Missing DNS requests on Windows machine](https://discuss.elastic.co/t/missing-dns-requests-on-windows-machine/286067)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 4\ **Last updated:** [October 8, 2021, 7:00am UTC](https://discuss.elastic.co/t/missing-dns-requests-on-windows-machine/286067 "2021-10-08T07:00:20Z")
Hey, I'm investigating outbound DNS connections from an Active Directory Domain Controller. It contacted the DNS server tm1.edgedns-tm.info which is apparently owned by Microsoft. Nothing overly suspicious, but I wante… --- ## [I am not seeing any logs from elastic-agent from windows hosts](https://discuss.elastic.co/t/i-am-not-seeing-any-logs-from-elastic-agent-from-windows-hosts/286152)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 3\ **Last updated:** [October 7, 2021, 6:43pm UTC](https://discuss.elastic.co/t/i-am-not-seeing-any-logs-from-elastic-agent-from-windows-hosts/286152 "2021-10-07T18:43:08Z")
Hi Team, Surprisingly my elastic version 7.15 with basic license have installed the fleet server and then configured windows-policy with elastic-endpoint and windows integration. Have enabled all the rules; however I am… --- ## [Fleet server agent unable to start- Connection refused](https://discuss.elastic.co/t/fleet-server-agent-unable-to-start-connection-refused/285818)
**Author:** [@Psyhil](https://discuss.elastic.co/u/Psyhil)\ **Replies:** 3\ **Last updated:** [October 7, 2021, 3:27pm UTC](https://discuss.elastic.co/t/fleet-server-agent-unable-to-start-connection-refused/285818 "2021-10-07T15:27:09Z")
Hi there, I have ELK running and am trying to test out Fleet and endpoint agent. To perform the test, I used the quick start deployment mode using self-signed certificate. However when trying to install the agent on a… --- ## [Machine Learning](https://discuss.elastic.co/t/machine-learning/285987)
**Author:** [@alaine](https://discuss.elastic.co/u/alaine)\ **Replies:** 2\ **Last updated:** [October 7, 2021, 1:13pm UTC](https://discuss.elastic.co/t/machine-learning/285987 "2021-10-07T13:13:21Z")
Good Morning, Ran into a weird use case and wondering if anyone has suggestions. We have a couple thousand endpoints sending winlogbeats to our cluster, and we are trying to provide some kind of visibility into uptime o… --- ## [Unable to see any login or failure event from windows hosts](https://discuss.elastic.co/t/unable-to-see-any-login-or-failure-event-from-windows-hosts/285725)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 2\ **Last updated:** [October 5, 2021, 5:33pm UTC](https://discuss.elastic.co/t/unable-to-see-any-login-or-failure-event-from-windows-hosts/285725 "2021-10-05T17:33:16Z")
Hi Folks, I have setup elastic SIEM 7.15 with fleet and integrations with elastic-agent and windows. I enrolled windows server in fleet and then I generated few failure events. However those are not being reflected on … --- ## [Enable Elastic Security prebuilt rules and ML jobs](https://discuss.elastic.co/t/enable-elastic-security-prebuilt-rules-and-ml-jobs/285061)
**Author:** [@bil\_15](https://discuss.elastic.co/u/bil_15)\ **Replies:** 4\ **Last updated:** [October 4, 2021, 10:27pm UTC](https://discuss.elastic.co/t/enable-elastic-security-prebuilt-rules-and-ml-jobs/285061 "2021-10-04T22:27:27Z")
Hello! I'd like to know if there is ability to enable Elastic Security prebuilt rules and ML jobs they require to work properly via API. I didn't managed to find any info on this, so perhaps this functionality is not a… --- ## [Endpoint Security without using Fleet](https://discuss.elastic.co/t/endpoint-security-without-using-fleet/281802)
**Author:** [@KevSex](https://discuss.elastic.co/u/KevSex)\ **Replies:** 9\ **Last updated:** [October 4, 2021, 2:52pm UTC](https://discuss.elastic.co/t/endpoint-security-without-using-fleet/281802 "2021-10-04T14:52:30Z")
Hi, Is it possible to use the Elastic Endpoint Security integration without utilising Fleet? We have a use case to protect endpoints with the Endpoint Security that has restricted access to the Elastic stack. Ideally,… --- ## [Elastic SIEM - Keeps Logging me Out](https://discuss.elastic.co/t/elastic-siem-keeps-logging-me-out/259057)
**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Replies:** 1\ **Last updated:** [October 4, 2021, 12:02pm UTC](https://discuss.elastic.co/t/elastic-siem-keeps-logging-me-out/259057 "2021-10-04T12:02:20Z")
Whenever I modify a rule I become forced logged out of the session. --- ## [Possibility to use ApiKeyAuthentication NEST (.NET client) with Elasticsearch APP](https://discuss.elastic.co/t/possibility-to-use-apikeyauthentication-nest-net-client-with-elasticsearch-app/285746)
**Author:** [@flesterh](https://discuss.elastic.co/u/flesterh)\ **Replies:** 0\ **Last updated:** [October 2, 2021, 4:47pm UTC](https://discuss.elastic.co/t/possibility-to-use-apikeyauthentication-nest-net-client-with-elasticsearch-app/285746 "2021-10-02T16:47:09Z")
Usecase: Enterpsie Elastic App Search 7.1.\* is used for searchenigine as crawler. We want to access data with from our .NET client NEST. 2 questions: Can we use the ApiKeyAuthentication within NEST 7.1.15 package as c… --- ## [“You do not have permission to access the requested page” error when accessing Kibana](https://discuss.elastic.co/t/you-do-not-have-permission-to-access-the-requested-page-error-when-accessing-kibana/285613)
**Author:** [@muralikri](https://discuss.elastic.co/u/muralikri)\ **Replies:** 0\ **Last updated:** [September 30, 2021, 4:10pm UTC](https://discuss.elastic.co/t/you-do-not-have-permission-to-access-the-requested-page-error-when-accessing-kibana/285613 "2021-09-30T16:10:01Z")
Hi, I am trying to configure SAML SSO in on premises Elasticsearch environment (kubernetes elasticseatrch & kibana) and getting "You do not have permission to access the requested page". have tried all settings and sti… --- ## [EQL Search by timestamp](https://discuss.elastic.co/t/eql-search-by-timestamp/285474)
**Author:** [@GuillaumeBrun](https://discuss.elastic.co/u/GuillaumeBrun)\ **Replies:** 0\ **Last updated:** [September 29, 2021, 12:49pm UTC](https://discuss.elastic.co/t/eql-search-by-timestamp/285474 "2021-09-29T12:49:42Z")
Hello, My problem is quite simple but I can't find the solution. I'm using Python to make GET calls on index using EQL. I would like to make this search only on the 5 past minutes logs. How can I do it ? Specify somet… --- ## [Can i tronsform alert or event to IDMEF(Intrusion Detection Message Exchange Format)](https://discuss.elastic.co/t/can-i-tronsform-alert-or-event-to-idmef-intrusion-detection-message-exchange-format/285287)
**Author:** [@bonus4u\_space](https://discuss.elastic.co/u/bonus4u_space)\ **Replies:** 0\ **Last updated:** [September 27, 2021, 10:44pm UTC](https://discuss.elastic.co/t/can-i-tronsform-alert-or-event-to-idmef-intrusion-detection-message-exchange-format/285287 "2021-09-27T22:44:17Z")
i want to normalize alerts from wireshark json format to the idmef standard format .any idea? --- ## [False Positives in the 1000's](https://discuss.elastic.co/t/false-positives-in-the-1000s/285019)
**Author:** [@tanner8302](https://discuss.elastic.co/u/tanner8302)\ **Replies:** 1\ **Last updated:** [September 23, 2021, 11:31pm UTC](https://discuss.elastic.co/t/false-positives-in-the-1000s/285019 "2021-09-23T23:31:55Z")
Has anyone noticed a "HUGE" amount of false positives that occur when enabling the Detection Rule \[Threat Intel Filebeat Module Indicator Match\]. This rule is tagged as follows Continuous Monitoring Elastic Elastic E… --- ## [No Elastic Security Events but Agents status is "green"](https://discuss.elastic.co/t/no-elastic-security-events-but-agents-status-is-green/284731)
**Author:** [@Eldoro](https://discuss.elastic.co/u/Eldoro)\ **Replies:** 2\ **Last updated:** [September 23, 2021, 8:33am UTC](https://discuss.elastic.co/t/no-elastic-security-events-but-agents-status-is-green/284731 "2021-09-23T08:33:19Z")
Hallo, after updaten from 7.13 to 7.14 the logging of the elastic security events is now longer working. The status of the agent is still "green". If I query the logs I get the following error: GET .ds-logs-elastic\_a… --- ## [Communication between elastic agent and fleet server](https://discuss.elastic.co/t/communication-between-elastic-agent-and-fleet-server/284845)
**Author:** [@Paurav\_Thakkar](https://discuss.elastic.co/u/Paurav_Thakkar)\ **Replies:** 0\ **Last updated:** [September 22, 2021, 10:16am UTC](https://discuss.elastic.co/t/communication-between-elastic-agent-and-fleet-server/284845 "2021-09-22T10:16:21Z")
Hi, I am new to elastic security and I am trying to get a better understanding of it. so how does the elastic agent communicate with fleet server (webhooks or API polling) and will there be any delay when I request some… [Previous page](https://discuss.elastic.co/c/security/83.md?page=39) [Next page](https://discuss.elastic.co/c/security/83.md?page=41)