# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=43 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 44 --- ## [Threshold Rule type - not able to send more than three field values in email action](https://discuss.elastic.co/t/threshold-rule-type-not-able-to-send-more-than-three-field-values-in-email-action/280309)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 0\ **Last updated:** [August 3, 2021, 12:38pm UTC](https://discuss.elastic.co/t/threshold-rule-type-not-able-to-send-more-than-three-field-values-in-email-action/280309 "2021-08-03T12:38:53Z")
Hi, Threshold rule type is not allowing to send more than three field values in email action body. Group by is allowed to do onyl for three fields and those field values are only are available in the aggregated alert ou… --- ## [SIEM Webhook](https://discuss.elastic.co/t/siem-webhook/280466)
**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Replies:** 0\ **Last updated:** [August 4, 2021, 6:43pm UTC](https://discuss.elastic.co/t/siem-webhook/280466 "2021-08-04T18:43:36Z")
How do i compose the webhook to pull the SIEM data ? , none of the prepopulated fields work --- ## [Elastic 7.13.3 update to 7.13.4 --- Ouch that was an interesting bug](https://discuss.elastic.co/t/elastic-7-13-3-update-to-7-13-4-ouch-that-was-an-interesting-bug/280354)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 2\ **Last updated:** [August 4, 2021, 4:27pm UTC](https://discuss.elastic.co/t/elastic-7-13-3-update-to-7-13-4-ouch-that-was-an-interesting-bug/280354 "2021-08-04T16:27:42Z")
So simple version to anyone that runs a custom CA for Fleet/Endpoint integration. Using fleet to manage your agents will delete the CA certificate if you put it in the Agent folder when you deploy it initially. The agen… --- ## [Elastic Entreprise SIEM question](https://discuss.elastic.co/t/elastic-entreprise-siem-question/280392)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 2\ **Last updated:** [August 4, 2021, 11:58am UTC](https://discuss.elastic.co/t/elastic-entreprise-siem-question/280392 "2021-08-04T11:58:33Z")
Hello, So in my company we want to make one SIEM for our clients, and we want to make them all in one cluster as they are small comapnies and don't generate a lot of logs / day. I would like to know if there is a poss… --- ## [Possible to have elastic security read existing data/index?](https://discuss.elastic.co/t/possible-to-have-elastic-security-read-existing-data-index/280018)
**Author:** [@rconroy](https://discuss.elastic.co/u/rconroy)\ **Replies:** 7\ **Last updated:** [August 3, 2021, 5:39pm UTC](https://discuss.elastic.co/t/possible-to-have-elastic-security-read-existing-data-index/280018 "2021-08-03T17:39:29Z")
I have what is possibly an odd question but I'm new with elastic security/siem and thought I would ask. Is it possible to have the elastic security read a different data stream or ingestion other than the agents? For e… --- ## [Elastic-agent.exe not running on target](https://discuss.elastic.co/t/elastic-agent-exe-not-running-on-target/279197)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 14\ **Last updated:** [August 3, 2021, 1:20am UTC](https://discuss.elastic.co/t/elastic-agent-exe-not-running-on-target/279197 "2021-08-03T01:20:43Z")
I have set up a virtual machine to install McAfee ePO and solidcore for testing. So I am taking the opportunity to connect my VM to the Elastic stack. I copied over the Agent and the agent.yml file. Made the changes t… --- ## [Wrong hosts last event elastic siem](https://discuss.elastic.co/t/wrong-hosts-last-event-elastic-siem/280176)
**Author:** [@artsius](https://discuss.elastic.co/u/artsius)\ **Replies:** 0\ **Last updated:** [August 2, 2021, 3:32am UTC](https://discuss.elastic.co/t/wrong-hosts-last-event-elastic-siem/280176 "2021-08-02T03:32:48Z")
I've some problem with last event in my elastic siem environment. The date is incorrect and I don't know how to fix this. could anyone give the suggests on this? I'm still new on Elasticsearch. --- ## [Simple way to deploy Elastic Security](https://discuss.elastic.co/t/simple-way-to-deploy-elastic-security/279910)
**Author:** [@lisa99](https://discuss.elastic.co/u/lisa99)\ **Replies:** 3\ **Last updated:** [July 29, 2021, 10:01pm UTC](https://discuss.elastic.co/t/simple-way-to-deploy-elastic-security/279910 "2021-07-29T22:01:18Z")
I am trying to install the Elastic Stack locally on a single VM to keep the setup simple. The use case is Security, which requires installing ELK as well as many configurations here and there to enable features like Ela… --- ## [Endpoint Filebeat memory 7.13.3 "rare event"](https://discuss.elastic.co/t/endpoint-filebeat-memory-7-13-3-rare-event/279759)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 1\ **Last updated:** [July 28, 2021, 3:39pm UTC](https://discuss.elastic.co/t/endpoint-filebeat-memory-7-13-3-rare-event/279759 "2021-07-28T15:39:33Z")
Minor bug with Filebeat and Endpoint. This is a rare event and only happened to 6 "known" machines out of 100. Filebeat memory utilization consumed the remaining host memory after a policy change. Steps that created t… --- ## [Waiting for a Fleet Server to connect… error](https://discuss.elastic.co/t/waiting-for-a-fleet-server-to-connect-error/279500)
**Author:** [@bm11100](https://discuss.elastic.co/u/bm11100)\ **Replies:** 4\ **Last updated:** [July 28, 2021, 1:53pm UTC](https://discuss.elastic.co/t/waiting-for-a-fleet-server-to-connect-error/279500 "2021-07-28T13:53:23Z")
We are running into an issue with Fleet, where on our Agents page, the Fleet server is stuck in what appears to be a continuous reboot cycle. We have terminated and redeployed the Fleet node and still run into this issu… --- ## [How do you specify the "forbidden hours" in the Detection Rule "Auditd Login Attempt at Forbidden Time"](https://discuss.elastic.co/t/how-do-you-specify-the-forbidden-hours-in-the-detection-rule-auditd-login-attempt-at-forbidden-time/279713)
**Author:** [@panagiss](https://discuss.elastic.co/u/panagiss)\ **Replies:** 2\ **Last updated:** [July 28, 2021, 11:29am UTC](https://discuss.elastic.co/t/how-do-you-specify-the-forbidden-hours-in-the-detection-rule-auditd-login-attempt-at-forbidden-time/279713 "2021-07-28T11:29:30Z")
I came across that Detection Rule but it seems unusual to me that i cannot specify the "Forbidden Times" somehow. My guess is that auditd has that event that can be triggered but the thing is that somehow you can control… --- ## [Difference between (event.module: system - event.action: user\_login) AND (event.module: auditd - event.action: logged-in)](https://discuss.elastic.co/t/difference-between-event-module-system-event-action-user-login-and-event-module-auditd-event-action-logged-in/279712)
**Author:** [@panagiss](https://discuss.elastic.co/u/panagiss)\ **Replies:** 2\ **Last updated:** [July 27, 2021, 4:03pm UTC](https://discuss.elastic.co/t/difference-between-event-module-system-event-action-user-login-and-event-module-auditd-event-action-logged-in/279712 "2021-07-27T16:03:48Z")
I have set on a host both packetbeat and auditbeat. I wanted to set a rule about login events but it confuses me a bit the separation between event.module: system and event.module: auditd. At the SIEM overview there is … --- ## [Log Rotate Elastic Endpoint Windows](https://discuss.elastic.co/t/log-rotate-elastic-endpoint-windows/279635)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 1\ **Last updated:** [July 26, 2021, 6:50pm UTC](https://discuss.elastic.co/t/log-rotate-elastic-endpoint-windows/279635 "2021-07-26T18:50:23Z")
Hello there, I would like to know if there´s any way to control the logs rotate using fleet admin page?? Or even throught the fleet policies??? I´m getting too many unexpected logs on the C:\\Program Files\\Elastic\\Endpoi… --- ## [Fleet enrollment Ok but doesnt appear on security administration page](https://discuss.elastic.co/t/fleet-enrollment-ok-but-doesnt-appear-on-security-administration-page/279192)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 2\ **Last updated:** [July 22, 2021, 12:28pm UTC](https://discuss.elastic.co/t/fleet-enrollment-ok-but-doesnt-appear-on-security-administration-page/279192 "2021-07-22T12:28:02Z")
Hi there, I cannot find why some servers appears on the security admin page and others not. Can someone point me to the right direction to sort this out? Follow the fleet agent screen: Security Admin page: Also… --- ## [Where can I add new apps for exploit protection in the on-premise product?](https://discuss.elastic.co/t/where-can-i-add-new-apps-for-exploit-protection-in-the-on-premise-product/279306)
**Author:** [@BionicSecurityMgr](https://discuss.elastic.co/u/BionicSecurityMgr)\ **Replies:** 0\ **Last updated:** [July 21, 2021, 6:38pm UTC](https://discuss.elastic.co/t/where-can-i-add-new-apps-for-exploit-protection-in-the-on-premise-product/279306 "2021-07-21T18:38:51Z")
I'm looking for guidance on how to add additional applications to my endgame policy threat | exploit configuration. The major browsers and office apps are there along with Java and Adobe, and I have the option to add app… --- ## [Elastic SIEM detection rule query permissions](https://discuss.elastic.co/t/elastic-siem-detection-rule-query-permissions/279242)
**Author:** [@admlko](https://discuss.elastic.co/u/admlko)\ **Replies:** 2\ **Last updated:** [July 21, 2021, 5:27pm UTC](https://discuss.elastic.co/t/elastic-siem-detection-rule-query-permissions/279242 "2021-07-21T17:27:30Z")
Hi, Just a simple question: I was wondering how does the detection engine in Kibana execute queries? I couldn't find any documentation about who (which user) runs the queries with which permissions. So is there an in… --- ## [Multiple Blocklists?](https://discuss.elastic.co/t/multiple-blocklists/279196)
**Author:** [@BionicSecurityMgr](https://discuss.elastic.co/u/BionicSecurityMgr)\ **Replies:** 1\ **Last updated:** [July 21, 2021, 4:48pm UTC](https://discuss.elastic.co/t/multiple-blocklists/279196 "2021-07-21T16:48:06Z")
Is there any way to use multiple block lists? I'm thinking of a situation where we can have different Block Lists for different groups of assets without the need to use multiple Endpoint servers. We had a bad hash cause… --- ## [Configuration Comparison and Reporting options](https://discuss.elastic.co/t/configuration-comparison-and-reporting-options/279195)
**Author:** [@BionicSecurityMgr](https://discuss.elastic.co/u/BionicSecurityMgr)\ **Replies:** 1\ **Last updated:** [July 21, 2021, 4:41pm UTC](https://discuss.elastic.co/t/configuration-comparison-and-reporting-options/279195 "2021-07-21T16:41:20Z")
New to EndGame aka Elastic Endpoint Security (EES). Inherited an on-premise stack. Question - does EES include a policy comparison or export function? My intention is to quickly compare policies by comparing the options… --- ## [ElasticSIEM unable to find \[logs-endpoint.alerts](https://discuss.elastic.co/t/elasticsiem-unable-to-find-logs-endpoint-alerts/277681)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 11\ **Last updated:** [July 21, 2021, 1:20pm UTC](https://discuss.elastic.co/t/elasticsiem-unable-to-find-logs-endpoint-alerts/277681 "2021-07-21T13:20:49Z")
I have been able to start using the elastic SIEM recently, and am having the following message show up in my Kibana, both in the UI as well as in the command line when I start the service. \ log \[15:02:19.220\] \[erro… --- ## [Elastic Agents error after installation: ...fleet-server returned an error: MaxLimit](https://discuss.elastic.co/t/elastic-agents-error-after-installation-fleet-server-returned-an-error-maxlimit/278716)
**Author:** [@jamespichardo](https://discuss.elastic.co/u/jamespichardo)\ **Replies:** 3\ **Last updated:** [July 19, 2021, 5:09pm UTC](https://discuss.elastic.co/t/elastic-agents-error-after-installation-fleet-server-returned-an-error-maxlimit/278716 "2021-07-19T17:09:21Z")
After installing, Elastic Agents it keeps in "Offline" state and "Healthy" intermittently. When checking Agent logs I found this error several times: -- \[elastic\_agent\]\[error\] Could not communicate with fleet-server Ch… --- ## [Assign Single Exception to Multiple Detection Rules](https://discuss.elastic.co/t/assign-single-exception-to-multiple-detection-rules/278930)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 1\ **Last updated:** [July 16, 2021, 8:38pm UTC](https://discuss.elastic.co/t/assign-single-exception-to-multiple-detection-rules/278930 "2021-07-16T20:38:00Z")
Hi All, I currently have a use-case where I have a few rules that looks at similar data, but are intended to detect different things. These rules have a very similar set of exceptions assigned to them. I'd like to be a… --- ## [Suppression of repeated alerts](https://discuss.elastic.co/t/suppression-of-repeated-alerts/277365)
**Author:** [@dhiegoalves](https://discuss.elastic.co/u/dhiegoalves)\ **Replies:** 1\ **Last updated:** [July 16, 2021, 6:05pm UTC](https://discuss.elastic.co/t/suppression-of-repeated-alerts/277365 "2021-07-16T18:05:04Z")
Hello guys! Is it possible to configure a suppression to a SIEM's rule on ELK SIEM module? For example, if 5 events to the same user.id and source.ip in 5 minuts, so will be trigged just 1 alert. --- ## [Verification\_exception Error during Rule Execution](https://discuss.elastic.co/t/verification-exception-error-during-rule-execution/275781)
**Author:** [@inf](https://discuss.elastic.co/u/inf)\ **Replies:** 3\ **Last updated:** [July 16, 2021, 6:02pm UTC](https://discuss.elastic.co/t/verification-exception-error-during-rule-execution/275781 "2021-07-16T18:02:43Z")
Hi there, I am facing a particular error regarding many pre-built Elastic rules. Once they were activated, many of them start failing when executing - with the error: An error occurred during rule execution: message: "v… --- ## [Double whitespace in Exception's field's value](https://discuss.elastic.co/t/double-whitespace-in-exceptions-fields-value/277909)
**Author:** [@inf](https://discuss.elastic.co/u/inf)\ **Replies:** 1\ **Last updated:** [July 16, 2021, 5:39pm UTC](https://discuss.elastic.co/t/double-whitespace-in-exceptions-fields-value/277909 "2021-07-16T17:39:40Z")
Hi there, I am trying to add an exception to a rule where these are the details given: Field: winlog.event\_data.ParentCommandLine Operator: is Value: C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe -… --- ## [I encountered three security-related issues when using elasticserrch version 7.6.1. Thank you for your help](https://discuss.elastic.co/t/i-encountered-three-security-related-issues-when-using-elasticserrch-version-7-6-1-thank-you-for-your-help/278838)
**Author:** [@yupengj](https://discuss.elastic.co/u/yupengj)\ **Replies:** 1\ **Last updated:** [July 16, 2021, 4:52pm UTC](https://discuss.elastic.co/t/i-encountered-three-security-related-issues-when-using-elasticserrch-version-7-6-1-thank-you-for-your-help/278838 "2021-07-16T16:52:39Z")
I encountered three security-related issues when using elasticserrch version 7.6.1. Thank you for your help. How does elasticserrch configure http response headers, such as X-Content-Type-Options, X-XSS-Protection, Con… --- ## [Cases as Metrics](https://discuss.elastic.co/t/cases-as-metrics/278545)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 0\ **Last updated:** [July 13, 2021, 1:20pm UTC](https://discuss.elastic.co/t/cases-as-metrics/278545 "2021-07-13T13:20:07Z")
Hi All, I was wondering if anyone has any ideas for how to use cases within Elastic security for gathering/reporting metrics? I'm looking for collecting metrics like, mean time to detection, mean time to mitigation, me… --- ## [Auditing all Linux clients with centralised server](https://discuss.elastic.co/t/auditing-all-linux-clients-with-centralised-server/278246)
**Author:** [@kaushalshriyan](https://discuss.elastic.co/u/kaushalshriyan)\ **Replies:** 3\ **Last updated:** [July 10, 2021, 5:39pm UTC](https://discuss.elastic.co/t/auditing-all-linux-clients-with-centralised-server/278246 "2021-07-10T17:39:32Z")
Hi, I have 20 Linux servers in the network. Is there a way to audit all Linux clients using a centralized server? For example, what commands are run by John on Linuxnode1? Steve on Linuxnode15? and so on and so forth to… --- ## [System requirements for ELK SIEM](https://discuss.elastic.co/t/system-requirements-for-elk-siem/278025)
**Author:** [@kmz161](https://discuss.elastic.co/u/kmz161)\ **Replies:** 1\ **Last updated:** [July 9, 2021, 7:10am UTC](https://discuss.elastic.co/t/system-requirements-for-elk-siem/278025 "2021-07-09T07:10:16Z")
Hi! I need depoly ELK SIEM for analyze Windows, Linux, routers logs. Network consist of 300 Windows PC , 15 Linux servers and 3 routers. What do CPU, RAM, HDD need for stable working ELK SIEM on Docker? Where I can fi… --- ## [Retrieve Documents in Threshold Signal](https://discuss.elastic.co/t/retrieve-documents-in-threshold-signal/274913)
**Author:** [@Amorik](https://discuss.elastic.co/u/Amorik)\ **Replies:** 5\ **Last updated:** [July 6, 2021, 2:54pm UTC](https://discuss.elastic.co/t/retrieve-documents-in-threshold-signal/274913 "2021-07-06T14:54:44Z")
When a signal is created it it contains a series of fields representing what i assume to be information regarding what triggered the rule. In particular is the signal.parent.\* fields (also signal.parents.\* - not that i u… --- ## [Detection Rule with query issues](https://discuss.elastic.co/t/detection-rule-with-query-issues/277706)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 4\ **Last updated:** [July 6, 2021, 7:24am UTC](https://discuss.elastic.co/t/detection-rule-with-query-issues/277706 "2021-07-06T07:24:26Z")
Hi All, I've made a custom detection rule to detect windows defender events related to malware or stop based on the below documentation: The query is as bellow: winlog.event\_id: "1002" or "1003" or "1005" or "1006" … [Previous page](https://discuss.elastic.co/c/security/83.md?page=42) [Next page](https://discuss.elastic.co/c/security/83.md?page=44)