# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=44 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 45 --- ## [Indicator matching rule recommendation](https://discuss.elastic.co/t/indicator-matching-rule-recommendation/277829)
**Author:** [@Ameer\_Mukadam](https://discuss.elastic.co/u/Ameer_Mukadam)\ **Replies:** 2\ **Last updated:** [July 6, 2021, 6:07am UTC](https://discuss.elastic.co/t/indicator-matching-rule-recommendation/277829 "2021-07-06T06:07:38Z")
Are there any recommendations regarding the use of indicator matching rules? I have ingesting threat intel data using the threat intel module from filebeat. Whenever I enable a rule to match logs to IOC the performance… --- ## [Authentications zero successes - SIEM](https://discuss.elastic.co/t/authentications-zero-successes-siem/276707)
**Author:** [@fabinho1314](https://discuss.elastic.co/u/fabinho1314)\ **Replies:** 2\ **Last updated:** [July 1, 2021, 3:25pm UTC](https://discuss.elastic.co/t/authentications-zero-successes-siem/276707 "2021-07-01T15:25:02Z")
Hi there, I deployed with azure the solution "Elasticsearch (Self-Managed)" and im getting an odd error. When i go to the SIEM part \> Hosts \> Authentications, it only returns fails and zero successes as per the image b… --- ## [Unusual Process For a Windows Host (rare\_process\_by\_host\_windows\_ecs)](https://discuss.elastic.co/t/unusual-process-for-a-windows-host-rare-process-by-host-windows-ecs/277078)
**Author:** [@ARDiver86](https://discuss.elastic.co/u/ARDiver86)\ **Replies:** 4\ **Last updated:** [July 1, 2021, 8:18am UTC](https://discuss.elastic.co/t/unusual-process-for-a-windows-host-rare-process-by-host-windows-ecs/277078 "2021-07-01T08:18:23Z")
This job appears to be looking at a list of process create events to determine if a process is new or existed previously. The issue I think we are having is it is alerting us on a lot of processes that existed previously… --- ## [EQL syntax error?](https://discuss.elastic.co/t/eql-syntax-error/277301)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 3\ **Last updated:** [June 30, 2021, 4:30pm UTC](https://discuss.elastic.co/t/eql-syntax-error/277301 "2021-06-30T16:30:01Z")
I'm trying to inspect the results of an EQL query (based on the built-in hosts modification rule). However when I run the EQL query : file where event.type in ("change", "creation") and file.path : ("/private/… --- ## [Log Stoppage alert from critical server - ELK7.12](https://discuss.elastic.co/t/log-stoppage-alert-from-critical-server-elk7-12/273915)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 6\ **Last updated:** [June 30, 2021, 3:04pm UTC](https://discuss.elastic.co/t/log-stoppage-alert-from-critical-server-elk7-12/273915 "2021-06-30T15:04:29Z")
Hello Team, Please help me to understand the best way to create the log stoppage alert for critical servers. It should be index specific. For example: Index "A" contains 3 Firewall device logs- fw1,fw2,fw3 Need to get… --- ## [Default action?](https://discuss.elastic.co/t/default-action/276208)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 3\ **Last updated:** [June 29, 2021, 11:55pm UTC](https://discuss.elastic.co/t/default-action/276208 "2021-06-29T23:55:55Z")
I think I've brought this up before but is there a way we can have a default action for detection rules please? Manually editing 600 rules is not my cup of tea! --- ## [Endpoints not showing up in Security Administration](https://discuss.elastic.co/t/endpoints-not-showing-up-in-security-administration/276878)
**Author:** [@Jukocross](https://discuss.elastic.co/u/Jukocross)\ **Replies:** 4\ **Last updated:** [June 29, 2021, 2:10am UTC](https://discuss.elastic.co/t/endpoints-not-showing-up-in-security-administration/276878 "2021-06-29T02:10:35Z")
Security administration unable to detect any host despite able to enroll the host with elastic agent (Status: Healthy). Installed version 7.13.2 ELK stack with self signed certificates. Setup fleet server and able to… --- ## [Elastic Agent filling up disk space with logs, disaster](https://discuss.elastic.co/t/elastic-agent-filling-up-disk-space-with-logs-disaster/276668)
**Author:** [@Achilleas](https://discuss.elastic.co/u/Achilleas)\ **Replies:** 6\ **Last updated:** [June 28, 2021, 5:03pm UTC](https://discuss.elastic.co/t/elastic-agent-filling-up-disk-space-with-logs-disaster/276668 "2021-06-28T17:03:52Z")
We had a meltdown on one of our servers, where the elastic agent filled up the disk space with logs (36GB of text logfiles, in 2 months), from a trial we had on the Elastic Cloud. I know I am to blame for installing an … --- ## [Suricata Agent Integration - Unable to grab eve.json](https://discuss.elastic.co/t/suricata-agent-integration-unable-to-grab-eve-json/277076)
**Author:** [@Verax](https://discuss.elastic.co/u/Verax)\ **Replies:** 0\ **Last updated:** [June 25, 2021, 3:00pm UTC](https://discuss.elastic.co/t/suricata-agent-integration-unable-to-grab-eve-json/277076 "2021-06-25T15:00:33Z")
Hello all, I have successfully added the Elastic Agent to my security onion host and it is correctly grabbing the Zeek logs. However, the agent doesn’t seem to be able to pull the Suricata logs even though it was doing … --- ## [ELK + Elastic Security Licensing](https://discuss.elastic.co/t/elk-elastic-security-licensing/277123)
**Author:** [@termcap](https://discuss.elastic.co/u/termcap)\ **Replies:** 2\ **Last updated:** [June 27, 2021, 1:28pm UTC](https://discuss.elastic.co/t/elk-elastic-security-licensing/277123 "2021-06-27T13:28:36Z")
Hi, I would like to know if Elastic Security/Fleet Server/Fleet Management and other features that come with the basic license are free for use for organizations or just for individuals ? I would like to use Elastic Se… --- ## [IP address to hostname or FQDN](https://discuss.elastic.co/t/ip-address-to-hostname-or-fqdn/277113)
**Author:** [@mashhoor\_gulati](https://discuss.elastic.co/u/mashhoor_gulati)\ **Replies:** 1\ **Last updated:** [June 27, 2021, 10:06am UTC](https://discuss.elastic.co/t/ip-address-to-hostname-or-fqdn/277113 "2021-06-27T10:06:23Z")
Hi, I'm new to Elastic Security. Network events are logged with destination IP address. Is there any way it can be translated to hostname/FQDN.? Is there any setting can be done for DNS resolution.? I'm currently run… --- ## [Search/Tag Rules with MITRE ATT&CK TTP](https://discuss.elastic.co/t/search-tag-rules-with-mitre-att-ck-ttp/277144)
**Author:** [@inf](https://discuss.elastic.co/u/inf)\ **Replies:** 0\ **Last updated:** [June 27, 2021, 8:05am UTC](https://discuss.elastic.co/t/search-tag-rules-with-mitre-att-ck-ttp/277144 "2021-06-27T08:05:35Z")
Hi there, Not sure if there is currently a way (else, this will be a suggestion) to search rules according to TTPs. Each rule appears to have at least TTP listed when we click into the rule, but it is not part of the t… --- ## [Using "message" in custom alert rule](https://discuss.elastic.co/t/using-message-in-custom-alert-rule/275899)
**Author:** [@EvanGertis](https://discuss.elastic.co/u/EvanGertis)\ **Replies:** 2\ **Last updated:** [June 25, 2021, 12:51pm UTC](https://discuss.elastic.co/t/using-message-in-custom-alert-rule/275899 "2021-06-25T12:51:31Z")
I would like to create an alert that follows: "message: some search string" When I create the alert and save it. I receive the following error "Bulk Indexing of signals failed: object mapping for \[source\] tried to par… --- ## [ThreatIntel + module configuration](https://discuss.elastic.co/t/threatintel-module-configuration/276652)
**Author:** [@malvivent7](https://discuss.elastic.co/u/malvivent7)\ **Replies:** 1\ **Last updated:** [June 25, 2021, 10:18am UTC](https://discuss.elastic.co/t/threatintel-module-configuration/276652 "2021-06-25T10:18:18Z")
Hi to all, i have enabled through filebeat modules the threatintel module and after that i have configured threatintel.yml activating otx and abusemalware than filebeat -e setup . So far so good but till now i dont see … --- ## [Threat detection rules VS beats](https://discuss.elastic.co/t/threat-detection-rules-vs-beats/275311)
**Author:** [@farciarz121](https://discuss.elastic.co/u/farciarz121)\ **Replies:** 1\ **Last updated:** [June 25, 2021, 10:26am UTC](https://discuss.elastic.co/t/threat-detection-rules-vs-beats/275311 "2021-06-25T10:26:30Z")
Can someone tell me if default detection rules are capable of triggering alerts base on logs from events (not from fleet). I.e. new user creation. I can not make it work. Also, how do I define my own custom policies that… --- ## [How do elastic Apply Severity to pre-built rules?](https://discuss.elastic.co/t/how-do-elastic-apply-severity-to-pre-built-rules/276437)
**Author:** [@Oliver2](https://discuss.elastic.co/u/Oliver2)\ **Replies:** 2\ **Last updated:** [June 25, 2021, 4:20am UTC](https://discuss.elastic.co/t/how-do-elastic-apply-severity-to-pre-built-rules/276437 "2021-06-25T04:20:21Z")
How is the pre-built detection rules severity worked out, is it a random number or is there some documented framework i cant seem to find any notes on it? --- ## [Timespan without a sequence](https://discuss.elastic.co/t/timespan-without-a-sequence/276370)
**Author:** [@ima](https://discuss.elastic.co/u/ima)\ **Replies:** 1\ **Last updated:** [June 24, 2021, 11:41pm UTC](https://discuss.elastic.co/t/timespan-without-a-sequence/276370 "2021-06-24T23:41:20Z")
hello guys, is there any other way to define a timespan without using sequence in eql rules creation --- ## [Process Ghosting Tool - 64 bits Only!](https://discuss.elastic.co/t/process-ghosting-tool-64-bits-only/276826)
**Author:** [@Iker](https://discuss.elastic.co/u/Iker)\ **Replies:** 1\ **Last updated:** [June 24, 2021, 11:32pm UTC](https://discuss.elastic.co/t/process-ghosting-tool-64-bits-only/276826 "2021-06-24T23:32:27Z")
Based in the excellent article published by Gabriel Landau (Process Ghosting a New Executable Image Tampering Attack, I have developed a tool for Process Ghosting, this should be of help for the detection of such behavio… --- ## [Elastic security](https://discuss.elastic.co/t/elastic-security/276968)
**Author:** [@Vladimir](https://discuss.elastic.co/u/Vladimir)\ **Replies:** 0\ **Last updated:** [June 24, 2021, 5:33pm UTC](https://discuss.elastic.co/t/elastic-security/276968 "2021-06-24T17:33:18Z")
I have Elastic and Kibana installed on server. I tried to set up the whole stuff properly so I am going according the documentation. I cant believe it is SOOOOOOO complicated to run elastic. I have a lot of services run… --- ## [Creating an email connector](https://discuss.elastic.co/t/creating-an-email-connector/275904)
**Author:** [@EvanGertis](https://discuss.elastic.co/u/EvanGertis)\ **Replies:** 4\ **Last updated:** [June 23, 2021, 6:06pm UTC](https://discuss.elastic.co/t/creating-an-email-connector/275904 "2021-06-23T18:06:33Z")
What exactly needs to be created for this action ? I am reviewing the documentation listed here: Email connector and action | Kibana Guide \[7.13\] | Elastic. --- ## [Endpoint 7.13 migration to 7.13.1 Lesson learned with Fleet “On-Prim” -Bad](https://discuss.elastic.co/t/endpoint-7-13-migration-to-7-13-1-lesson-learned-with-fleet-on-prim-bad/275343)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 15\ **Last updated:** [June 23, 2021, 3:23pm UTC](https://discuss.elastic.co/t/endpoint-7-13-migration-to-7-13-1-lesson-learned-with-fleet-on-prim-bad/275343 "2021-06-23T15:23:13Z")
Failed. Kibana 7.13.1 migration from 7.13.0 failed. Testing setup. Single node. Fleet policies with Elastic-Endpoint only. Agent log's set to enable on settings to upload. When the Elastic instance went offline for upd… --- ## [Close Detection Alerts After Adding Exceptions - \`winlog.event\_data\`](https://discuss.elastic.co/t/close-detection-alerts-after-adding-exceptions-winlog-event-data/276788)
**Author:** [@inf](https://discuss.elastic.co/u/inf)\ **Replies:** 0\ **Last updated:** [June 23, 2021, 12:33pm UTC](https://discuss.elastic.co/t/close-detection-alerts-after-adding-exceptions-winlog-event-data/276788 "2021-06-23T12:33:27Z")
Hi there, I am looking to see if it there are plans to close detection alerts after adding exceptions (while the detection alert is still open) - specifically for my use-case below? My initial thought was to filter for… --- ## [Sort/Toggle Detection Rules by Severity or Risk Score](https://discuss.elastic.co/t/sort-toggle-detection-rules-by-severity-or-risk-score/276064)
**Author:** [@scanlan](https://discuss.elastic.co/u/scanlan)\ **Replies:** 2\ **Last updated:** [June 22, 2021, 5:48pm UTC](https://discuss.elastic.co/t/sort-toggle-detection-rules-by-severity-or-risk-score/276064 "2021-06-22T17:48:30Z")
Is it possible to sort detection rules by risk score or severity? I would like to only enable rules above a certain severity/risk score. What is the best way to do this? --- ## [ETW Events](https://discuss.elastic.co/t/etw-events/276597)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 0\ **Last updated:** [June 22, 2021, 3:20am UTC](https://discuss.elastic.co/t/etw-events/276597 "2021-06-22T03:20:32Z")
Will Elastic Agent support ETW events in the future or am I better off using Filebeat with standard log files at the moment? See Microsoft ETW (Event Tracing for Windows) Listener. Look for a Beats to deal with Service … --- ## [Whitelist processes in Uncommon Processes](https://discuss.elastic.co/t/whitelist-processes-in-uncommon-processes/276285)
**Author:** [@bmbrit](https://discuss.elastic.co/u/bmbrit)\ **Replies:** 4\ **Last updated:** [June 21, 2021, 9:12pm UTC](https://discuss.elastic.co/t/whitelist-processes-in-uncommon-processes/276285 "2021-06-21T21:12:07Z")
Hi, I don't want to see processes that are legitimate. Is it possible to whitelist processes so that they don't appear in the uncommon processes? Thanks in advance, Brit --- ## [Elastic-endpoint process still running when I stop the elastic-agent service](https://discuss.elastic.co/t/elastic-endpoint-process-still-running-when-i-stop-the-elastic-agent-service/276269)
**Author:** [@lotus](https://discuss.elastic.co/u/lotus)\ **Replies:** 2\ **Last updated:** [June 18, 2021, 1:35am UTC](https://discuss.elastic.co/t/elastic-endpoint-process-still-running-when-i-stop-the-elastic-agent-service/276269 "2021-06-18T01:35:56Z")
Hello, we have installed elastic-agent-7.12 on Ubuntu 18.04 to test Endpoint security recently, but we found the elastic-endpoint take a quit large CPU, we decide to sopt it temporarily. while we stop the service elas… --- ## [OSQuery Live Queries don't go through](https://discuss.elastic.co/t/osquery-live-queries-dont-go-through/274428)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 14\ **Last updated:** [June 17, 2021, 9:31pm UTC](https://discuss.elastic.co/t/osquery-live-queries-dont-go-through/274428 "2021-06-17T21:31:07Z")
Hey, I'm using a 7.13 stack with 7.13 Elastic Agents on multiple machines. I have the OSQuery Manager Integration installed (v. 0.2.3) and applied a respective policy to three Agents (2x Ubuntu 20.04, 1x Windows Server … --- ## [Elastic-Agent stand alone host only sends very few events](https://discuss.elastic.co/t/elastic-agent-stand-alone-host-only-sends-very-few-events/276164)
**Author:** [@maof97](https://discuss.elastic.co/u/maof97)\ **Replies:** 1\ **Last updated:** [June 17, 2021, 2:03pm UTC](https://discuss.elastic.co/t/elastic-agent-stand-alone-host-only-sends-very-few-events/276164 "2021-06-17T14:03:54Z")
Hello, because the new fleet stuff doesn't work for me (see here), I tried setting up an elastic agent in "stand alone" mode. In Kibana\>Fleet\>Agents I clicked on "Add agent", downloaded the EA files and extracted them … --- ## [{{#context.alerts}} not showing up in markdown](https://discuss.elastic.co/t/context-alerts-not-showing-up-in-markdown/276177)
**Author:** [@EvanGertis](https://discuss.elastic.co/u/EvanGertis)\ **Replies:** 2\ **Last updated:** [June 16, 2021, 8:11pm UTC](https://discuss.elastic.co/t/context-alerts-not-showing-up-in-markdown/276177 "2021-06-16T20:11:24Z")
I am trying to create a simple notification based off of the post described here: {{#context.alerts}} - \*Beat Name\*: {noformat}{{beat.name}}{noformat} {{/context.alerts}} However, the context.alerts block is not get… --- ## [Filtering Rules according to "Last response" Field](https://discuss.elastic.co/t/filtering-rules-according-to-last-response-field/275743)
**Author:** [@inf](https://discuss.elastic.co/u/inf)\ **Replies:** 2\ **Last updated:** [June 16, 2021, 12:37pm UTC](https://discuss.elastic.co/t/filtering-rules-according-to-last-response-field/275743 "2021-06-16T12:37:43Z")
Hi there, As I understand, there are 3 kinds of Last response for rules - Succeeded, Warning, and Failure. I would like to filter rules according to just these 3 statuses. It appears that there is currently no way of d… [Previous page](https://discuss.elastic.co/c/security/83.md?page=43) [Next page](https://discuss.elastic.co/c/security/83.md?page=45)