# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=42 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 43 --- ## [Common File for adding email address in SIEM Detection email action](https://discuss.elastic.co/t/common-file-for-adding-email-address-in-siem-detection-email-action/282341)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 1\ **Last updated:** [August 29, 2021, 8:58am UTC](https://discuss.elastic.co/t/common-file-for-adding-email-address-in-siem-detection-email-action/282341 "2021-08-29T08:58:48Z")
Hi, Please share if there any way to keep common file for Email "To" address and use parameter in detection email action instead of adding email address in each Detections Rules. I am using ELK 7.13.4. Thanks in adva… --- ## [Error when trying to install fleet server (self-managed)](https://discuss.elastic.co/t/error-when-trying-to-install-fleet-server-self-managed/281370)
**Author:** [@Dovan](https://discuss.elastic.co/u/Dovan)\ **Replies:** 2\ **Last updated:** [August 26, 2021, 6:58pm UTC](https://discuss.elastic.co/t/error-when-trying-to-install-fleet-server-self-managed/281370 "2021-08-26T18:58:28Z")
I'm having this error when trying to install the fleet server on a machine, I didn't find anything about the forums and troubleshooting guide, could someone help me? error: 'missing enrolllment api key' root@xxxx:/hom… --- ## [Network overview page does not load completely](https://discuss.elastic.co/t/network-overview-page-does-not-load-completely/280582)
**Author:** [@termcap](https://discuss.elastic.co/u/termcap)\ **Replies:** 1\ **Last updated:** [August 25, 2021, 5:26pm UTC](https://discuss.elastic.co/t/network-overview-page-does-not-load-completely/280582 "2021-08-25T17:26:15Z")
I have Elastic Security running on version 7.14. Unfortunately I am unable to get the Elastic Security Network Overview page to load completely. \[Please check the attached screenshot\] The lowest section of the page … --- ## [Unable to install Fleet/Agent](https://discuss.elastic.co/t/unable-to-install-fleet-agent/282283)
**Author:** [@Andre\_GIRBAL](https://discuss.elastic.co/u/Andre_GIRBAL)\ **Replies:** 1\ **Last updated:** [August 25, 2021, 2:41am UTC](https://discuss.elastic.co/t/unable-to-install-fleet-agent/282283 "2021-08-25T02:41:51Z")
Hi, I'm installing an ELk stack OnPrem for test purpose. (v7.14) I want to try the Elastic Security suite, and manage to install Fleet and Agent on Windows Server. Configuration of my stack ELK seems to be ok. Just I … --- ## [Detection and Response for ProxyShell Activity](https://discuss.elastic.co/t/detection-and-response-for-proxyshell-activity/282407)
**Author:** [@variable](https://discuss.elastic.co/u/variable)\ **Replies:** 0\ **Last updated:** [August 24, 2021, 7:58pm UTC](https://discuss.elastic.co/t/detection-and-response-for-proxyshell-activity/282407 "2021-08-24T19:58:56Z")
Detection and Response for ProxyShell Activity Executive Summary On August 21, 2021, the Cybersecurity and Infrastructure Security Agency (CISA) released an urgent notice related to the exploitation of ProxyShell vulnera… --- ## [Will elastic agent support more beats in future?](https://discuss.elastic.co/t/will-elastic-agent-support-more-beats-in-future/282291)
**Author:** [@spzala](https://discuss.elastic.co/u/spzala)\ **Replies:** 2\ **Last updated:** [August 24, 2021, 5:47am UTC](https://discuss.elastic.co/t/will-elastic-agent-support-more-beats-in-future/282291 "2021-08-24T05:47:51Z")
We are planning to use Elastic agent and fleet in one of the workflows. So, are there any possibilities that elastic agent and fleet may include more beats like a packetbeat in future releases? OR what's the road map of … --- ## [Creating alert when event didn't occur](https://discuss.elastic.co/t/creating-alert-when-event-didnt-occur/282195)
**Author:** [@Marduuk](https://discuss.elastic.co/u/Marduuk)\ **Replies:** 5\ **Last updated:** [August 24, 2021, 5:44am UTC](https://discuss.elastic.co/t/creating-alert-when-event-didnt-occur/282195 "2021-08-24T05:44:46Z")
Hey, For past few days I have been trying to create a rule that will trigger when something doesn't happen. So let's say we have two executables, malware.exe and antivirus.exe. I want to write a rule that would trigger … --- ## [Detection of a behavior preceded or followed by an event type](https://discuss.elastic.co/t/detection-of-a-behavior-preceded-or-followed-by-an-event-type/281127)
**Author:** [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\ **Replies:** 1\ **Last updated:** [August 23, 2021, 3:45pm UTC](https://discuss.elastic.co/t/detection-of-a-behavior-preceded-or-followed-by-an-event-type/281127 "2021-08-23T15:45:52Z")
Hello every body, I have a question about the rule’s creation , Is it possible to have rules with these conditions, if yes how? More than 40 events with event.action:”block” from the same IP address followed or preced… --- ## [Alerts dont match time on server](https://discuss.elastic.co/t/alerts-dont-match-time-on-server/281604)
**Author:** [@nwenner76](https://discuss.elastic.co/u/nwenner76)\ **Replies:** 2\ **Last updated:** [August 20, 2021, 9:49pm UTC](https://discuss.elastic.co/t/alerts-dont-match-time-on-server/281604 "2021-08-20T21:49:03Z")
Running Wazuh 7.10.02. Host, Wazuh, and Kibana show the right time, but when I get the alerts in my email, the body of the email shows the wrong time. Setup is all on the same server. All systems are in the same office… --- ## [Does the elastic agent contain winlogbeat?](https://discuss.elastic.co/t/does-the-elastic-agent-contain-winlogbeat/282043)
**Author:** [@shardinator](https://discuss.elastic.co/u/shardinator)\ **Replies:** 1\ **Last updated:** [August 20, 2021, 1:04pm UTC](https://discuss.elastic.co/t/does-the-elastic-agent-contain-winlogbeat/282043 "2021-08-20T13:04:55Z")
Hi When looking at event logs shipped from elastic agent 7.14.0 the agent.type is filebeat. So is the elastic agent actually using winlogbeat? If not, does the used filebeat have feature parity with winlogbeat? Cheers… --- ## [Elastic Endpoint Security crashes and memory errors](https://discuss.elastic.co/t/elastic-endpoint-security-crashes-and-memory-errors/282003)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 6\ **Last updated:** [August 19, 2021, 9:49pm UTC](https://discuss.elastic.co/t/elastic-endpoint-security-crashes-and-memory-errors/282003 "2021-08-19T21:49:53Z")
Hey, I'm getting multiple different Elastic Endpoint crashes across different hosts and across Elastic Agent 7.14 and 7.13.2. I provide exemplary crashes below, from the Windows Application Event log. In terms of crash… --- ## [Elastic Endpoint Windows Event Log - Security Channel](https://discuss.elastic.co/t/elastic-endpoint-windows-event-log-security-channel/281993)
**Author:** [@mikemitchell](https://discuss.elastic.co/u/mikemitchell)\ **Replies:** 1\ **Last updated:** [August 19, 2021, 5:02pm UTC](https://discuss.elastic.co/t/elastic-endpoint-windows-event-log-security-channel/281993 "2021-08-19T17:02:14Z")
Does the Elastic Security Windows Integration or the Endpoint Integration not have the ability to pull from the Security channel of Windows Event Logs? I had to create a new Custom channel to pull in security events fro… --- ## [Elastic Agents disappearing](https://discuss.elastic.co/t/elastic-agents-disappearing/280172)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 23\ **Last updated:** [August 19, 2021, 8:27am UTC](https://discuss.elastic.co/t/elastic-agents-disappearing/280172 "2021-08-19T08:27:36Z")
I'm on 7.13.4 using fleet server and my agents have disappeared overnight. I've tried restarting the entire cluster (in elastic cloud) and the agents all still show as offline in fleet. The cluster health is al good too… --- ## [Endpoint-security State changed to DEGRADED: Protecting with policy](https://discuss.elastic.co/t/endpoint-security-state-changed-to-degraded-protecting-with-policy/281308)
**Author:** [@Alexey\_Shalin](https://discuss.elastic.co/u/Alexey_Shalin)\ **Replies:** 4\ **Last updated:** [August 17, 2021, 3:18am UTC](https://discuss.elastic.co/t/endpoint-security-state-changed-to-degraded-protecting-with-policy/281308 "2021-08-17T03:18:09Z")
Good Day, After some mins after staring agent Elastic Agent .. status changed from Health to UnHealth (with Endpoint Security Integration) I check logs and find line: endpoint-security State changed to DEGRADED: Protec… --- ## ["This event cannot be analyzed since it has incompatible field mappings" On my own log](https://discuss.elastic.co/t/this-event-cannot-be-analyzed-since-it-has-incompatible-field-mappings-on-my-own-log/280319)
**Author:** [@nberens](https://discuss.elastic.co/u/nberens)\ **Replies:** 2\ **Last updated:** [August 17, 2021, 2:43pm UTC](https://discuss.elastic.co/t/this-event-cannot-be-analyzed-since-it-has-incompatible-field-mappings-on-my-own-log/280319 "2021-08-17T14:43:56Z")
Hello, i am currently integrating our watchguard vpn logs into our Elasticsearch siem. I basically build a logstash rule that takes its Syslog output and mapps it onto ECS. While everthing now works as expected, i no… --- ## [Endpoint Security DEGRADED, Malware failed to enable due to potential system deadlock](https://discuss.elastic.co/t/endpoint-security-degraded-malware-failed-to-enable-due-to-potential-system-deadlock/281337)
**Author:** [@c1jt](https://discuss.elastic.co/u/c1jt)\ **Replies:** 7\ **Last updated:** [August 17, 2021, 8:35am UTC](https://discuss.elastic.co/t/endpoint-security-degraded-malware-failed-to-enable-due-to-potential-system-deadlock/281337 "2021-08-17T08:35:50Z")
Hi I have a node with endpoint-security policy applied, but is set to "DEGRADED" and "Unhealthy" after policy is applied/updated. Apparantly due to "potential system deadlock" Security Endpoints says: \> Malware \>\> Con… --- ## [Detection Rules don't alert](https://discuss.elastic.co/t/detection-rules-dont-alert/280736)
**Author:** [@omlette](https://discuss.elastic.co/u/omlette)\ **Replies:** 4\ **Last updated:** [August 13, 2021, 8:41pm UTC](https://discuss.elastic.co/t/detection-rules-dont-alert/280736 "2021-08-13T20:41:53Z")
I'm setting up detection rules, so I wanted to start small and verify that the workflows was functioning, so I've enabled the Whoami Process Activity. I've run the whoami command several times over the last several hours… --- ## [7.14 - Windows agent deployed with Fleet, but not sending data](https://discuss.elastic.co/t/7-14-windows-agent-deployed-with-fleet-but-not-sending-data/281347)
**Author:** [@finbarr996](https://discuss.elastic.co/u/finbarr996)\ **Replies:** 6\ **Last updated:** [August 13, 2021, 6:02pm UTC](https://discuss.elastic.co/t/7-14-windows-agent-deployed-with-fleet-but-not-sending-data/281347 "2021-08-13T18:02:47Z")
I am using self-generated certs created on the ES master node, running a brand new install of 7.14 - all the server components (Es, Kibana, LS, MB & FB) are talking and working well with each other. After deploying the … --- ## [Enroll and start the Elastic Agent - Windows](https://discuss.elastic.co/t/enroll-and-start-the-elastic-agent-windows/281275)
**Author:** [@alenraz05](https://discuss.elastic.co/u/alenraz05)\ **Replies:** 6\ **Last updated:** [August 13, 2021, 2:05pm UTC](https://discuss.elastic.co/t/enroll-and-start-the-elastic-agent-windows/281275 "2021-08-13T14:05:42Z")
Hi I can not find the elastic-agent.exe in the winlogbeat-7.14.0-windows-x86\_64 folder --- ## [How to create a rule that compares two dynamic numbers](https://discuss.elastic.co/t/how-to-create-a-rule-that-compares-two-dynamic-numbers/281269)
**Author:** [@Carrie](https://discuss.elastic.co/u/Carrie)\ **Replies:** 0\ **Last updated:** [August 12, 2021, 9:40pm UTC](https://discuss.elastic.co/t/how-to-create-a-rule-that-compares-two-dynamic-numbers/281269 "2021-08-12T21:40:03Z")
Hi there, I am new to ELK. Currently I have 3 applications talking with each other. I want to check if the message actually gets sent. When the message gets sent or received, it will print out some logging For instance… --- ## [Openness in Elastic Security's Agent artifacts](https://discuss.elastic.co/t/openness-in-elastic-securitys-agent-artifacts/281121)
**Author:** [@mark.dufresne](https://discuss.elastic.co/u/mark.dufresne)\ **Replies:** 1\ **Last updated:** [August 12, 2021, 6:51pm UTC](https://discuss.elastic.co/t/openness-in-elastic-securitys-agent-artifacts/281121 "2021-08-12T18:51:21Z")
You may have seen the twitter thread regarding a security researcher decrypting our endpoint protection artifacts in Elastic Agent. Our vision at Elastic Security is to protect the world’s data from attack by making secu… --- ## [Alerts ceased to be generated](https://discuss.elastic.co/t/alerts-ceased-to-be-generated/280671)
**Author:** [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\ **Replies:** 4\ **Last updated:** [August 12, 2021, 10:37am UTC](https://discuss.elastic.co/t/alerts-ceased-to-be-generated/280671 "2021-08-12T10:37:04Z")
Hello every body, I have a problem, The alerts have ceased to be generated today at the detection level, after checking I noticed that the rules are matched but the alerts are not generated and the siem-signals-default … --- ## [Can Elastic Security read existing non default pre-existing indices?](https://discuss.elastic.co/t/can-elastic-security-read-existing-non-default-pre-existing-indices/280935)
**Author:** [@rconroy](https://discuss.elastic.co/u/rconroy)\ **Replies:** 7\ **Last updated:** [August 10, 2021, 11:49pm UTC](https://discuss.elastic.co/t/can-elastic-security-read-existing-non-default-pre-existing-indices/280935 "2021-08-10T23:49:22Z")
Hello We've been using ES for some time and have a number of indices that contain all the data we want to capture from windows hosts and other data sources such as firewalls etc... The reality is that I've already captu… --- ## [Elastic SIEM TheHive Integration](https://discuss.elastic.co/t/elastic-siem-thehive-integration/279729)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [August 10, 2021, 12:52pm UTC](https://discuss.elastic.co/t/elastic-siem-thehive-integration/279729 "2021-08-10T12:52:20Z")
Hello, Is there any plan to integrate more SIEM Case connectors, for example for TheHive? Willem --- ## [Mapping elastic rule to o365 logs](https://discuss.elastic.co/t/mapping-elastic-rule-to-o365-logs/280849)
**Author:** [@Jorge\_Dieguez\_Perez](https://discuss.elastic.co/u/Jorge_Dieguez_Perez)\ **Replies:** 0\ **Last updated:** [August 9, 2021, 8:13pm UTC](https://discuss.elastic.co/t/mapping-elastic-rule-to-o365-logs/280849 "2021-08-09T20:13:49Z")
Hi guys, can someone tell me what is the field in o365 logs related to event.category? --- ## [Detection Rule: Alert when botnet website is accessed](https://discuss.elastic.co/t/detection-rule-alert-when-botnet-website-is-accessed/280733)
**Author:** [@xahmi](https://discuss.elastic.co/u/xahmi)\ **Replies:** 0\ **Last updated:** [August 8, 2021, 2:18pm UTC](https://discuss.elastic.co/t/detection-rule-alert-when-botnet-website-is-accessed/280733 "2021-08-08T14:18:17Z")
Hello, I added a botnet list to Elasticsearch with logstash. I would like to create now an alert when the destination.address = matchs to an entry from my index. How would you do that with detection rules? Kind regard… --- ## [Elastic search TLS certificate setup, handshake failed. unexpected remote node](https://discuss.elastic.co/t/elastic-search-tls-certificate-setup-handshake-failed-unexpected-remote-node/280684)
**Author:** [@Syed\_Hami](https://discuss.elastic.co/u/Syed_Hami)\ **Replies:** 0\ **Last updated:** [August 6, 2021, 8:59pm UTC](https://discuss.elastic.co/t/elastic-search-tls-certificate-setup-handshake-failed-unexpected-remote-node/280684 "2021-08-06T20:59:00Z")
I am getting this issue : stacktrace": \["org.elasticsearch.transport.ConnectTransportException: \[my-server01\]\[172.17.0.2:9300\] handshake failed. unexpected remote node {my-server02}{C5Yp3aubR9ySTOAYm7txiA}{ZvtLxxD3SU6v… --- ## [Gap not refreshing on 7.14?](https://discuss.elastic.co/t/gap-not-refreshing-on-7-14/280610)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 0\ **Last updated:** [August 6, 2021, 3:26am UTC](https://discuss.elastic.co/t/gap-not-refreshing-on-7-14/280610 "2021-08-06T03:26:35Z")
In the rule monitoring of detection rules the "Last Gap" field doesn't seem to update....I've duplicated a rule and the gap resets to zero : How is this value updating and is there a way I can reset it? Hilton --- ## [Processors in Endpoint/Elastic-Agent](https://discuss.elastic.co/t/processors-in-endpoint-elastic-agent/279889)
**Author:** [@bm11100](https://discuss.elastic.co/u/bm11100)\ **Replies:** 2\ **Last updated:** [August 5, 2021, 3:28pm UTC](https://discuss.elastic.co/t/processors-in-endpoint-elastic-agent/279889 "2021-08-05T15:28:52Z")
Hello, We are testing Elastic-Agent and found that the streams configuration we can add "processors" that take care of adding custom fields for things like Filebeats/Metricbeats. This is a useful feature but we cannot f… --- ## [Default DIsable Alert Sync for new Cases](https://discuss.elastic.co/t/default-disable-alert-sync-for-new-cases/279777)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 3\ **Last updated:** [August 5, 2021, 8:26am UTC](https://discuss.elastic.co/t/default-disable-alert-sync-for-new-cases/279777 "2021-08-05T08:26:52Z")
Hello, Can we set the "Sync alerts" option for new cases default to 'off' or disabled? Tried it and it doesn't make a lot of sense for me. Setting a case to "In Progress" does not seem to set the related timeline alerts… [Previous page](https://discuss.elastic.co/c/security/83.md?page=41) [Next page](https://discuss.elastic.co/c/security/83.md?page=43)