# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=41 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 42 --- ## [Single behavior generates several alerts](https://discuss.elastic.co/t/single-behavior-generates-several-alerts/283943)
**Author:** [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\ **Replies:** 3\ **Last updated:** [September 21, 2021, 12:15pm UTC](https://discuss.elastic.co/t/single-behavior-generates-several-alerts/283943 "2021-09-21T12:15:54Z")
Hello evry body, I have a lot of alerts generated by a single behavior scan from the address IP x.x.x.x to the ip address Y (each time the rule is executed another alerts is created). Is there a way to have only one ale… --- ## [Rules not triggering alerts](https://discuss.elastic.co/t/rules-not-triggering-alerts/282899)
**Author:** [@john12](https://discuss.elastic.co/u/john12)\ **Replies:** 5\ **Last updated:** [September 21, 2021, 7:40am UTC](https://discuss.elastic.co/t/rules-not-triggering-alerts/282899 "2021-09-21T07:40:47Z")
Hello, I am creating so simple custom rules, which supposed to trigger alerts my ELK version is 7.14 i have tested the query in the discover section and it retrieve a result, so the rule should trigger and alert is t… --- ## [Configuration of OpenID connect for Elasticsearch 7.14.1 is getting failed with trial version](https://discuss.elastic.co/t/configuration-of-openid-connect-for-elasticsearch-7-14-1-is-getting-failed-with-trial-version/284477)
**Author:** [@hari97](https://discuss.elastic.co/u/hari97)\ **Replies:** 9\ **Last updated:** [September 21, 2021, 4:54am UTC](https://discuss.elastic.co/t/configuration-of-openid-connect-for-elasticsearch-7-14-1-is-getting-failed-with-trial-version/284477 "2021-09-21T04:54:33Z")
I have installed latest elasticsearch and kibana (7.14.1) version using docker images. My setup is single-node elasticsearch. Initiated trial version for 30 days and enabled https for elasticsearch using ssl certificate… --- ## [Elastic agent goes Unhealthy after deploy Endpoint integration](https://discuss.elastic.co/t/elastic-agent-goes-unhealthy-after-deploy-endpoint-integration/284564)
**Author:** [@SiRVaNdO](https://discuss.elastic.co/u/SiRVaNdO)\ **Replies:** 1\ **Last updated:** [September 20, 2021, 4:39pm UTC](https://discuss.elastic.co/t/elastic-agent-goes-unhealthy-after-deploy-endpoint-integration/284564 "2021-09-20T16:39:51Z")
Hi there, I have several Elastic agents with different policies and some integrations. I want to do a PoC with the endpoint but when I deploy the endpoint integration in the policy and it deploys to the elastic agents,… --- ## [Threat intel integration](https://discuss.elastic.co/t/threat-intel-integration/282663)
**Author:** [@tejas.tech](https://discuss.elastic.co/u/tejas.tech)\ **Replies:** 3\ **Last updated:** [September 15, 2021, 1:05pm UTC](https://discuss.elastic.co/t/threat-intel-integration/282663 "2021-09-15T13:05:38Z")
Team, I have installed Filebeat 7.14.X agent and have enabled the threatintel module but unable to get feeds from all the threat intel. Could you please help us out on this? --- ## [CentOS Stream8 Elastic Agent not sending streams](https://discuss.elastic.co/t/centos-stream8-elastic-agent-not-sending-streams/283859)
**Author:** [@uf0](https://discuss.elastic.co/u/uf0)\ **Replies:** 2\ **Last updated:** [September 15, 2021, 9:04am UTC](https://discuss.elastic.co/t/centos-stream8-elastic-agent-not-sending-streams/283859 "2021-09-15T09:04:09Z")
Hello I have just setup a fresh install of ELK + a few agents running on Ubuntu and everything works as expected. However, as soon as I add the same agent version, 7.14.1 on a CentOS Strem 8, it fails with the followin… --- ## [Audit Concurrent Logons](https://discuss.elastic.co/t/audit-concurrent-logons/284236)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 0\ **Last updated:** [September 15, 2021, 2:29am UTC](https://discuss.elastic.co/t/audit-concurrent-logons/284236 "2021-09-15T02:29:33Z")
I've been asked to come up with a way to audit concurrent Windows logins, and am trying to find anyone who has had success with this in Kibana. I can easily audit logons (4624) and logoffs (4647), but haven't yet figured… --- ## [Case Management System and external connectors](https://discuss.elastic.co/t/case-management-system-and-external-connectors/284189)
**Author:** [@thisisxgp](https://discuss.elastic.co/u/thisisxgp)\ **Replies:** 1\ **Last updated:** [September 15, 2021, 12:39am UTC](https://discuss.elastic.co/t/case-management-system-and-external-connectors/284189 "2021-09-15T00:39:46Z")
Hello guys, Currently, Elastic Security can send case updates to ServiceNow / Jira / Swimlane / IBM Resilient according to the official documentation. Are there any plans on expanding this list? I'd be very interested … --- ## [Can't select Agent Policy when trying to add agent](https://discuss.elastic.co/t/cant-select-agent-policy-when-trying-to-add-agent/284195)
**Author:** [@buzzdeee](https://discuss.elastic.co/u/buzzdeee)\ **Replies:** 0\ **Last updated:** [September 14, 2021, 2:25pm UTC](https://discuss.elastic.co/t/cant-select-agent-policy-when-trying-to-add-agent/284195 "2021-09-14T14:25:58Z")
I restored a backup on my test cluster with ELK stack version 7.13.3, then directly upgraded everything to 7.14.1. Now when looking at fleet, I'm at the stage of adding a fleet server, the second point: Select an Agent … --- ## [Detection and Response for CVE-2021-40444](https://discuss.elastic.co/t/detection-and-response-for-cve-2021-40444/283800)
**Author:** [@devonkerr](https://discuss.elastic.co/u/devonkerr)\ **Replies:** 1\ **Last updated:** [September 14, 2021, 9:46am UTC](https://discuss.elastic.co/t/detection-and-response-for-cve-2021-40444/283800 "2021-09-14T09:46:31Z")
Detection and Response for CVE-2021-40444 Executive summary Elastic Security Intelligence & Analytics has identified additional behaviors related to or inspired by the disclosure of CVE-2021-40444, a remote code executio… --- ## [Linux-Endpoint-security State changed to DEGRADED-Artifact endpoint-trustlist-linux-v1 is unavailablee](https://discuss.elastic.co/t/linux-endpoint-security-state-changed-to-degraded-artifact-endpoint-trustlist-linux-v1-is-unavailablee/282061)
**Author:** [@pedimave](https://discuss.elastic.co/u/pedimave)\ **Replies:** 3\ **Last updated:** [September 14, 2021, 5:21am UTC](https://discuss.elastic.co/t/linux-endpoint-security-state-changed-to-degraded-artifact-endpoint-trustlist-linux-v1-is-unavailablee/282061 "2021-09-14T05:21:33Z")
I have installed Elastic 7.14 and testing Endoint Security over fleet with Linux Machines (Debian 10). All seems that is working but after few minutes appear the message : State changed to DEGRADED with all of them. Af… --- ## [Looking for a list of "Out of the Box" Use Cases for Elastic SIEM](https://discuss.elastic.co/t/looking-for-a-list-of-out-of-the-box-use-cases-for-elastic-siem/284101)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 1\ **Last updated:** [September 13, 2021, 4:34pm UTC](https://discuss.elastic.co/t/looking-for-a-list-of-out-of-the-box-use-cases-for-elastic-siem/284101 "2021-09-13T16:34:18Z")
I am working on a secure project that is utilizing ELK SIEM and we are looking for Use Cases that we can direct the client towards for answering what the Elastic SIEM can do for them. Is there a link or area that I can … --- ## [Fleet](https://discuss.elastic.co/t/fleet/284049)
**Author:** [@suraj\_kumar3](https://discuss.elastic.co/u/suraj_kumar3)\ **Replies:** 1\ **Last updated:** [September 13, 2021, 2:13pm UTC](https://discuss.elastic.co/t/fleet/284049 "2021-09-13T14:13:23Z")
I have created a fleet server and that is showing under fleet\>agents and status is healthy as well but while enrolling agent to fleet server it shows its enrolled but status on kibana fleet\>agents UI is coming as unhealt… --- ## [Endpoint Security custom notification logo](https://discuss.elastic.co/t/endpoint-security-custom-notification-logo/283709)
**Author:** [@bm11100](https://discuss.elastic.co/u/bm11100)\ **Replies:** 1\ **Last updated:** [September 13, 2021, 1:35pm UTC](https://discuss.elastic.co/t/endpoint-security-custom-notification-logo/283709 "2021-09-13T13:35:54Z")
Hello, Will there be an option in the future to modify the logo that appears on the pop up notifications for Endpoint Security malware/ransomware, similar to how you can modify the pop up message? It appears to be loca… --- ## [Run Elastic detection rule in non real time logs](https://discuss.elastic.co/t/run-elastic-detection-rule-in-non-real-time-logs/283787)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 1\ **Last updated:** [September 11, 2021, 1:15pm UTC](https://discuss.elastic.co/t/run-elastic-detection-rule-in-non-real-time-logs/283787 "2021-09-11T13:15:22Z")
Hello, I have some windows log files and I have uploaded them to my cluster using winlogbeat \[Not sure how to read from .evtx files | Winlogbeat Reference \[master\] | Elastic\] I would like to know if it's possible to ru… --- ## [Do i need to install other "beats" with the elastic and endpoint agents or is something else wrong?](https://discuss.elastic.co/t/do-i-need-to-install-other-beats-with-the-elastic-and-endpoint-agents-or-is-something-else-wrong/281609)
**Author:** [@rconroy](https://discuss.elastic.co/u/rconroy)\ **Replies:** 32\ **Last updated:** [September 10, 2021, 10:31pm UTC](https://discuss.elastic.co/t/do-i-need-to-install-other-beats-with-the-elastic-and-endpoint-agents-or-is-something-else-wrong/281609 "2021-09-10T22:31:45Z")
Forgive me is this is a silly question but i have installed the agents, under Hosts in security it shows them connected, yet there is no data in the dashboards, everything says "all values returned zero" or "no data to … --- ## [SIEM open rules](https://discuss.elastic.co/t/siem-open-rules/283710)
**Author:** [@wallacepalace](https://discuss.elastic.co/u/wallacepalace)\ **Replies:** 2\ **Last updated:** [September 9, 2021, 1:54am UTC](https://discuss.elastic.co/t/siem-open-rules/283710 "2021-09-09T01:54:06Z")
Hey there, how are ur? I'm posting here some rules I made for detecting communications with botnets, command and control (C2), VNC scanners, SSH, MySQL, RDP, DNS, Telnet, HTTP, TFTP. Using honeypots, blacklists, IP rank… --- ## [Packetbeat 7.14.1 process.env not added to the document](https://discuss.elastic.co/t/packetbeat-7-14-1-process-env-not-added-to-the-document/283698)
**Author:** [@Rodrigo\_Bernardo](https://discuss.elastic.co/u/Rodrigo_Bernardo)\ **Replies:** 0\ **Last updated:** [September 8, 2021, 5:09pm UTC](https://discuss.elastic.co/t/packetbeat-7-14-1-process-env-not-added-to-the-document/283698 "2021-09-08T17:09:24Z")
Hello there, I tried to follow the documentation but with no success. Am I doing something wrong or packetbeat has issues sending the process environment into the document. I am using the latest version of packetbeat 7.… --- ## [Find exceptions in indices](https://discuss.elastic.co/t/find-exceptions-in-indices/283656)
**Author:** [@bil\_15](https://discuss.elastic.co/u/bil_15)\ **Replies:** 0\ **Last updated:** [September 8, 2021, 12:49pm UTC](https://discuss.elastic.co/t/find-exceptions-in-indices/283656 "2021-09-08T12:49:50Z")
Hello! I've created exception on the rule and interested in the way it works. For ex, in Splunk we're receiving suppressed events anyway, so they are still stored in appropriate index, but they are don't visible in SIE… --- ## [Elastic Agent 7.14 -- Strange bug during enrollment "Elastic fleet agent bug"](https://discuss.elastic.co/t/elastic-agent-7-14-strange-bug-during-enrollment-elastic-fleet-agent-bug/281594)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 15\ **Last updated:** [September 7, 2021, 4:16pm UTC](https://discuss.elastic.co/t/elastic-agent-7-14-strange-bug-during-enrollment-elastic-fleet-agent-bug/281594 "2021-09-07T16:16:32Z")
Elastic Agent 7.14 on-prim Elastic cluster. Effected OS Windows Server 2016/2019 both OS's have the same issue. Error pulled from a failed enrollment attempt of the client directly. Fleet agent in prod is running on Ce… --- ## [Threshold Rule type - not able to send more than three field values in email action](https://discuss.elastic.co/t/threshold-rule-type-not-able-to-send-more-than-three-field-values-in-email-action/283525)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 0\ **Last updated:** [September 7, 2021, 12:02pm UTC](https://discuss.elastic.co/t/threshold-rule-type-not-able-to-send-more-than-three-field-values-in-email-action/283525 "2021-09-07T12:02:44Z")
Continuing the discussion from Threshold Rule type - not able to send more than three field values in email action: Waiting for a reply for this issue. --- ## [Msip threat intel import not working](https://discuss.elastic.co/t/msip-threat-intel-import-not-working/283210)
**Author:** [@finbarr996](https://discuss.elastic.co/u/finbarr996)\ **Replies:** 2\ **Last updated:** [September 5, 2021, 6:05pm UTC](https://discuss.elastic.co/t/msip-threat-intel-import-not-working/283210 "2021-09-05T18:05:07Z")
I've edited the /etc/filebeat/modules.d/threatintel.yml and updated the entry for misp to enable it and also to add the API key from my local misp server. My config looks like this: misp: enabled: true var.in… --- ## [Web defacement monitoring](https://discuss.elastic.co/t/web-defacement-monitoring/283327)
**Author:** [@Lakshan\_Chamidu](https://discuss.elastic.co/u/Lakshan_Chamidu)\ **Replies:** 0\ **Last updated:** [September 4, 2021, 4:55am UTC](https://discuss.elastic.co/t/web-defacement-monitoring/283327 "2021-09-04T04:55:48Z")
how can we monitor web defacement using elk stack? --- ## [SIEM Rules Bulk duplicate](https://discuss.elastic.co/t/siem-rules-bulk-duplicate/283290)
**Author:** [@pcosic](https://discuss.elastic.co/u/pcosic)\ **Replies:** 0\ **Last updated:** [September 3, 2021, 2:36pm UTC](https://discuss.elastic.co/t/siem-rules-bulk-duplicate/283290 "2021-09-03T14:36:32Z")
Hey Community, I want to apply the SIEM Rules on a custom Index. How can I do this with many Rules? So manually I have to duplicate the original Rule and then I can edit the duplicated Rule. I tried to do this with Ki… --- ## [Sample Threat Intel Module Filebeat.YML File that you can share?](https://discuss.elastic.co/t/sample-threat-intel-module-filebeat-yml-file-that-you-can-share/283071)
**Author:** [@tanner8302](https://discuss.elastic.co/u/tanner8302)\ **Replies:** 10\ **Last updated:** [September 3, 2021, 1:53pm UTC](https://discuss.elastic.co/t/sample-threat-intel-module-filebeat-yml-file-that-you-can-share/283071 "2021-09-03T13:53:36Z")
Has anyone got the Threat Feed in elastic working? If so could you share your filebeat.yml sample so that I can refer to it. I cannot get filebeat to start using the module samples provided by elastic. --- ## [Elastic agent does not send logs](https://discuss.elastic.co/t/elastic-agent-does-not-send-logs/281799)
**Author:** [@john12](https://discuss.elastic.co/u/john12)\ **Replies:** 7\ **Last updated:** [August 31, 2021, 9:31am UTC](https://discuss.elastic.co/t/elastic-agent-does-not-send-logs/281799 "2021-08-31T09:31:20Z")
Hello, i have problem that i do not receiving logs by elastic agents managed by a fleet. fleet server working fine, and agents connected to fleet server status is "Healthy" i tried different machines, and i had enabled… --- ## [Watch configuration (advance watch - Jason queries for cyber security)](https://discuss.elastic.co/t/watch-configuration-advance-watch-jason-queries-for-cyber-security/274632)
**Author:** [@farciarz121](https://discuss.elastic.co/u/farciarz121)\ **Replies:** 4\ **Last updated:** [August 31, 2021, 1:52am UTC](https://discuss.elastic.co/t/watch-configuration-advance-watch-jason-queries-for-cyber-security/274632 "2021-08-31T01:52:57Z")
Good morning everyone, I have recently setup ELK with elastic on cloud and I am in the process of configuring watch. I want to mainly use this to monitor my environment from suspicious events like: new user created, 5-1… --- ## [Set custom ID for elastic-agent](https://discuss.elastic.co/t/set-custom-id-for-elastic-agent/282419)
**Author:** [@bm11100](https://discuss.elastic.co/u/bm11100)\ **Replies:** 7\ **Last updated:** [August 30, 2021, 7:17pm UTC](https://discuss.elastic.co/t/set-custom-id-for-elastic-agent/282419 "2021-08-30T19:17:56Z")
Hello, Is it possible to set or create a custom agent.id during or after the elastic-agent install, whether it be via a command line argument or an API call we can make? For example, instead of agent.id being a uuid li… --- ## [Endpoint capability restriction error](https://discuss.elastic.co/t/endpoint-capability-restriction-error/281610)
**Author:** [@bm11100](https://discuss.elastic.co/u/bm11100)\ **Replies:** 9\ **Last updated:** [August 30, 2021, 3:41pm UTC](https://discuss.elastic.co/t/endpoint-capability-restriction-error/281610 "2021-08-30T15:41:22Z")
We are on a 7.14 stack with 7.14 agent running. I'm seeing an error below which I've never seen before. It causes the Agent state to be degraded. I'm a bit unclear on the capability restriction 'I deny(\*) portion of the… --- ## [Reduce duplicate signals/ alerts](https://discuss.elastic.co/t/reduce-duplicate-signals-alerts/282768)
**Author:** [@jaspher](https://discuss.elastic.co/u/jaspher)\ **Replies:** 0\ **Last updated:** [August 29, 2021, 10:23pm UTC](https://discuss.elastic.co/t/reduce-duplicate-signals-alerts/282768 "2021-08-29T22:23:10Z")
Hi, Is it possible to mute/ ignore repeating alerts for a period of time? For example, if a c2 beacon is detected, an alert does not need to be generated again if the signal is still open/ not closed. In Alienvault, t… [Previous page](https://discuss.elastic.co/c/security/83.md?page=40) [Next page](https://discuss.elastic.co/c/security/83.md?page=42)