# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=45 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 46 --- ## [Elastic Agent 7.13.1 keeps degrading endpoint security for macOS](https://discuss.elastic.co/t/elastic-agent-7-13-1-keeps-degrading-endpoint-security-for-macos/275207)
**Author:** [@fgierlinger](https://discuss.elastic.co/u/fgierlinger)\ **Replies:** 2\ **Last updated:** [June 14, 2021, 7:17pm UTC](https://discuss.elastic.co/t/elastic-agent-7-13-1-keeps-degrading-endpoint-security-for-macos/275207 "2021-06-14T19:17:20Z")
The endpoint security for macOS keeps getting to the status 'DEGRADED'. I simply create a new policy, add endpoint security to the policy and enroll the fleet-agent with the provided command. Full-Disk Access Permission… --- ## [Detections - Kibana](https://discuss.elastic.co/t/detections-kibana/275716)
**Author:** [@farciarz121](https://discuss.elastic.co/u/farciarz121)\ **Replies:** 7\ **Last updated:** [June 13, 2021, 7:04pm UTC](https://discuss.elastic.co/t/detections-kibana/275716 "2021-06-13T19:04:31Z")
Hi, I am trying to use detection rules in Kibana. I am testing it on predefined rules under Security module. To be exact " User Account Creation" . I am using winlog to send out data to kibana. I see user creation event… --- ## [Detection and Response for HAFNIUM Activity](https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289)
**Author:** [@devonkerr](https://discuss.elastic.co/u/devonkerr)\ **Replies:** 2\ **Last updated:** [March 10, 2021, 10:47pm UTC](https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289 "2021-03-10T22:47:14Z")
Detection and Response for HAFNIUM Activity Executive summary On March 2, 2021, Microsoft released a security update for on-premises Exchange servers to address vulnerabilities being exploited. Security vendors are seein… --- ## [EQL library where](https://discuss.elastic.co/t/eql-library-where/275524)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [June 12, 2021, 7:57pm UTC](https://discuss.elastic.co/t/eql-library-where/275524 "2021-06-12T19:57:22Z")
Hello, Just noticed an EQL query in Suspicious RDP ActiveX Client Loaded | Elastic Security Solution \[7.13\] | Elastic where a "library where" clause is used. What kind of events contain library? I always though the firs… --- ## [Rule for detecting email domain](https://discuss.elastic.co/t/rule-for-detecting-email-domain/273802)
**Author:** [@realtech2338](https://discuss.elastic.co/u/realtech2338)\ **Replies:** 1\ **Last updated:** [June 12, 2021, 4:07am UTC](https://discuss.elastic.co/t/rule-for-detecting-email-domain/273802 "2021-06-12T04:07:16Z")
I would like to create a rule to detect emails coming from specific domain for Strat malware email delivery. Please guide me how to do that: --- ## [Console use to find new accounts created](https://discuss.elastic.co/t/console-use-to-find-new-accounts-created/275709)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 0\ **Last updated:** [June 11, 2021, 6:29pm UTC](https://discuss.elastic.co/t/console-use-to-find-new-accounts-created/275709 "2021-06-11T18:29:36Z")
Good Afternoon. I have now been using and testing Elastic Stack for over a month and have been able to get pretty far in it. I am working with WinLogBeats, FileBeats and MetricBeats (All at version 7.12.1)now and one … --- ## [Endpoint 7.12.x migration to 7.13 Lesson learned with Fleet "On-Prim"](https://discuss.elastic.co/t/endpoint-7-12-x-migration-to-7-13-lesson-learned-with-fleet-on-prim/274244)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 7\ **Last updated:** [June 11, 2021, 4:10pm UTC](https://discuss.elastic.co/t/endpoint-7-12-x-migration-to-7-13-lesson-learned-with-fleet-on-prim/274244 "2021-06-11T16:10:44Z")
EDIT: Use caution on 7.13 and laptops/tablets. Normal runtime on my test machines are 7 hours. With Endpoint 7.13 its down to 1.5 hours due to excessive CPU utilization. This is AMD and Intel platforms with current Win 1… --- ## [Cannot Install Fleet Server](https://discuss.elastic.co/t/cannot-install-fleet-server/275012)
**Author:** [@Nico\_17](https://discuss.elastic.co/u/Nico_17)\ **Replies:** 1\ **Last updated:** [June 10, 2021, 2:17pm UTC](https://discuss.elastic.co/t/cannot-install-fleet-server/275012 "2021-06-10T14:17:30Z")
Hello there, Server info: 1 - I´m running ubuntu server 18.04 2 - Elk stack running on 7.13 version fleet server creation does not work. root@elastic:/tmp/agent/elastic-agent-7.13.1-linux-x86\_64# sudo ./elastic-age… --- ## [Error when installing fleet server](https://discuss.elastic.co/t/error-when-installing-fleet-server/274280)
**Author:** [@Jonathon\_Penn](https://discuss.elastic.co/u/Jonathon_Penn)\ **Replies:** 8\ **Last updated:** [June 10, 2021, 11:38am UTC](https://discuss.elastic.co/t/error-when-installing-fleet-server/274280 "2021-06-10T11:38:05Z")
When attempting to install a fleet server for a cluster running on an on-prem installation of Elastic Enterprise, I get the following error: user@fleet01:/opt/elastic-agent$ sudo elastic-agent enroll -f --fleet-server-e… --- ## [Elastic-agent msi?](https://discuss.elastic.co/t/elastic-agent-msi/274970)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 2\ **Last updated:** [June 8, 2021, 6:39pm UTC](https://discuss.elastic.co/t/elastic-agent-msi/274970 "2021-06-08T18:39:46Z")
Hi Folks, How are folks deploying elastic-agent? I'd like to use intune to deploy elastic-agent however there is currently no .msi file, therefore: can we have a .msi file pretty please? How are folks doing this atm? … --- ## [Fleet Server keeps crashing](https://discuss.elastic.co/t/fleet-server-keeps-crashing/274444)
**Author:** [@Ameer\_Mukadam](https://discuss.elastic.co/u/Ameer_Mukadam)\ **Replies:** 6\ **Last updated:** [June 8, 2021, 2:54pm UTC](https://discuss.elastic.co/t/fleet-server-keeps-crashing/274444 "2021-06-08T14:54:55Z")
So I wanted to explore the new fleet changes which where introduced lately I dod a complete new setup to get hands on with it. But I am not able to get the fleet server running it keeps crashing with exit code 1 and I am… --- ## [ELK Agent - Parse Custom NGINX Log](https://discuss.elastic.co/t/elk-agent-parse-custom-nginx-log/275203)
**Author:** [@peganet](https://discuss.elastic.co/u/peganet)\ **Replies:** 0\ **Last updated:** [June 7, 2021, 8:50pm UTC](https://discuss.elastic.co/t/elk-agent-parse-custom-nginx-log/275203 "2021-06-07T20:50:19Z")
Hello there, I am using "Custom Log Format" on my NGINX Reverse Proxy server. I want to make a Dashboard for myself, but the logs appear as messages. When I use the common log format instead of Custom, the data appears … --- ## [EQL cidrmatch issue](https://discuss.elastic.co/t/eql-cidrmatch-issue/274885)
**Author:** [@ima](https://discuss.elastic.co/u/ima)\ **Replies:** 3\ **Last updated:** [June 7, 2021, 1:46pm UTC](https://discuss.elastic.co/t/eql-cidrmatch-issue/274885 "2021-06-07T13:46:28Z")
hello guys, I created an eql rule for ssh access I wanna match multiple IP ranges but I get this error that the destination.ip field is text and not IP can you please suggest me another way to do that. here's my query { … --- ## [Endpoint Security Not Showing Host Events](https://discuss.elastic.co/t/endpoint-security-not-showing-host-events/274918)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 3\ **Last updated:** [June 4, 2021, 12:18pm UTC](https://discuss.elastic.co/t/endpoint-security-not-showing-host-events/274918 "2021-06-04T12:18:36Z")
Hello there, I need to understand why the endpoint security is not showing even after enroll the fleet agents. Follow my screens: Endpoint log: {"@timestamp":"2021-06-03T20:11:54.0871431Z","agent":{"id":"7991… --- ## [Security vulnerability support in ES 6.8.8](https://discuss.elastic.co/t/security-vulnerability-support-in-es-6-8-8/274872)
**Author:** [@bhupendra.mskhatri](https://discuss.elastic.co/u/bhupendra.mskhatri)\ **Replies:** 4\ **Last updated:** [June 4, 2021, 3:49am UTC](https://discuss.elastic.co/t/security-vulnerability-support-in-es-6-8-8/274872 "2021-06-04T03:49:40Z")
We ship ES 6.8.8 zip (windows) and tar(non-windows) with our application. I understand that 6.8.8 has reached EOL (Elastic Product End of Life Dates | Elastic). If any security vulnerability is reported in 6.8.8, will i… --- ## [Signal Field Schema Documentation](https://discuss.elastic.co/t/signal-field-schema-documentation/274912)
**Author:** [@Amorik](https://discuss.elastic.co/u/Amorik)\ **Replies:** 0\ **Last updated:** [June 3, 2021, 7:06pm UTC](https://discuss.elastic.co/t/signal-field-schema-documentation/274912 "2021-06-03T19:06:27Z")
Detection's creates the .siem-signals index responsible for housing alerts generated by the system. While it conforms to ECS the fields under signal.\* are not documented GitHub - elastic/ecs: Elastic Common Schema. Is th… --- ## [Discover is not working for range between \ - "now "](https://discuss.elastic.co/t/discover-is-not-working-for-range-between-date-now/274641)
**Author:** [@farciarz121](https://discuss.elastic.co/u/farciarz121)\ **Replies:** 2\ **Last updated:** [June 3, 2021, 4:52pm UTC](https://discuss.elastic.co/t/discover-is-not-working-for-range-between-date-now/274641 "2021-06-03T16:52:22Z")
I have a strange problem. In discovery tab, if I specify time between lets say Jun 1, 2021@ 07:56:46 -\> now I get no results However if I search Jun 1, 2021@ 07:56:46 -\>Jun 1, 2021@ 10:00:46 everyth… --- ## [Problem with detection \[rules\]](https://discuss.elastic.co/t/problem-with-detection-rules/274443)
**Author:** [@farciarz121](https://discuss.elastic.co/u/farciarz121)\ **Replies:** 2\ **Last updated:** [June 3, 2021, 4:51pm UTC](https://discuss.elastic.co/t/problem-with-detection-rules/274443 "2021-06-03T16:51:55Z")
I have successfully transferred logs from winlog to logstash on prem to elastic/kibana cloud. I have created index pattern and discovered data. In order to test if everything works fine I went have created a new user on … --- ## [Fleet Server won't start - certificate error](https://discuss.elastic.co/t/fleet-server-wont-start-certificate-error/274617)
**Author:** [@finbarr996](https://discuss.elastic.co/u/finbarr996)\ **Replies:** 2\ **Last updated:** [June 3, 2021, 9:06am UTC](https://discuss.elastic.co/t/fleet-server-wont-start-certificate-error/274617 "2021-06-03T09:06:51Z")
I've been running 7.12 with 10 test endpoints all operating in Fleet without any problem. After upgrading to 7.13, I'm trying to re-deploy to the test endpoints (after manually removing the previous agent on each endpoi… --- ## [Elastic agent log parsing](https://discuss.elastic.co/t/elastic-agent-log-parsing/274827)
**Author:** [@Guncixx](https://discuss.elastic.co/u/Guncixx)\ **Replies:** 0\ **Last updated:** [June 3, 2021, 6:59am UTC](https://discuss.elastic.co/t/elastic-agent-log-parsing/274827 "2021-06-03T06:59:39Z")
While testing Elastic SIEM and different shippers I discovered that both filebeat and elastic agent is not parsing Ubuntu auth log completely, there are some events where user and some other fields not getting populated.… --- ## [Cannot Install Fleet Server](https://discuss.elastic.co/t/cannot-install-fleet-server/274764)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 2\ **Last updated:** [June 2, 2021, 5:17pm UTC](https://discuss.elastic.co/t/cannot-install-fleet-server/274764 "2021-06-02T17:17:29Z")
Hello there, Server info: 1 - I´m running ubuntu server 18.04 2 - Elk stack running on 7.13 version I´m trying to add a fleet server on a self managed host but no luck. Following the kibana instructions this is what … --- ## [SIEM prebuilt rules](https://discuss.elastic.co/t/siem-prebuilt-rules/274724)
**Author:** [@tarekilani](https://discuss.elastic.co/u/tarekilani)\ **Replies:** 2\ **Last updated:** [June 2, 2021, 2:43pm UTC](https://discuss.elastic.co/t/siem-prebuilt-rules/274724 "2021-06-02T14:43:17Z")
Hello, I'm searching for prebuild rules for elastic SIEM, i found that i can use elastic provided rules : But i would like to know if there is any other source to get pre build rules for elastic SIEM, for example rul… --- ## [Detection rule: Failed login attempts](https://discuss.elastic.co/t/detection-rule-failed-login-attempts/274590)
**Author:** [@bnk](https://discuss.elastic.co/u/bnk)\ **Replies:** 2\ **Last updated:** [June 2, 2021, 10:51am UTC](https://discuss.elastic.co/t/detection-rule-failed-login-attempts/274590 "2021-06-02T10:51:35Z")
Hi, I've created my own detection rule for employees failed login attempts. It does work but when signal comes to Security -\> Detection dashboard, it do not show user.name or host.name. This is screen shot of my rule: … --- ## [Using Kibana to detect DDOS attacks for Analysis - Home Lab](https://discuss.elastic.co/t/using-kibana-to-detect-ddos-attacks-for-analysis-home-lab/274363)
**Author:** [@momo1104](https://discuss.elastic.co/u/momo1104)\ **Replies:** 3\ **Last updated:** [June 1, 2021, 10:17pm UTC](https://discuss.elastic.co/t/using-kibana-to-detect-ddos-attacks-for-analysis-home-lab/274363 "2021-06-01T22:17:24Z")
Hello everyone, i'm new to Infosec and very new to ELK stack. I am running a home lab inside a VM. I've downloaded a sample DDos dataset from kaggle.com and ingested that data into elk stack, but not really sure what to… --- ## [Detection rule kquery will not trigger but the query match](https://discuss.elastic.co/t/detection-rule-kquery-will-not-trigger-but-the-query-match/273085)
**Author:** [@leon3](https://discuss.elastic.co/u/leon3)\ **Replies:** 3\ **Last updated:** [May 31, 2021, 12:03pm UTC](https://discuss.elastic.co/t/detection-rule-kquery-will-not-trigger-but-the-query-match/273085 "2021-05-31T12:03:54Z")
Hi I have a weird issue when use kquery in detection rules. I use a simple query to match a field and triggering action for that but the rule will not be triggered while its query is matching in the specified interval. … --- ## [Threshold detection not working with group by](https://discuss.elastic.co/t/threshold-detection-not-working-with-group-by/274362)
**Author:** [@Billz1026](https://discuss.elastic.co/u/Billz1026)\ **Replies:** 2\ **Last updated:** [May 31, 2021, 3:57am UTC](https://discuss.elastic.co/t/threshold-detection-not-working-with-group-by/274362 "2021-05-31T03:57:27Z")
Hi All, I am using Elastic version 7.12. I want to create a detection rule based on the threshold. My requirements is as follows. Identify possible Bruteforce attack coming from same source IP. If there are more than … --- ## [Detection Rule - Output of a aggregation bucket should match with other types of logs in the same index](https://discuss.elastic.co/t/detection-rule-output-of-a-aggregation-bucket-should-match-with-other-types-of-logs-in-the-same-index/274345)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 0\ **Last updated:** [May 28, 2021, 1:02pm UTC](https://discuss.elastic.co/t/detection-rule-output-of-a-aggregation-bucket-should-match-with-other-types-of-logs-in-the-same-index/274345 "2021-05-28T13:02:20Z")
Hi, Can someone please help to create a detection rule based on logic mentioned below. All unique mac.address field name with common.role:rogue should be aggregated and matched againewith the mac.address field name wit… --- ## [Detection rules which are based on indices where host field is fetched as string are not generating the alerts](https://discuss.elastic.co/t/detection-rules-which-are-based-on-indices-where-host-field-is-fetched-as-string-are-not-generating-the-alerts/274406)
**Author:** [@aditi\_salunke](https://discuss.elastic.co/u/aditi_salunke)\ **Replies:** 0\ **Last updated:** [May 29, 2021, 4:37pm UTC](https://discuss.elastic.co/t/detection-rules-which-are-based-on-indices-where-host-field-is-fetched-as-string-are-not-generating-the-alerts/274406 "2021-05-29T16:37:52Z")
Bulk Indexing of signals failed: object mapping for \[host\] tried to parse field \[host\] as object, but found a concrete value name: "\:\" rule id: "\" signals index: ".siem-signals-default" So… --- ## [Can't uninstall Elastic Endpoint on macOS](https://discuss.elastic.co/t/cant-uninstall-elastic-endpoint-on-macos/273986)
**Author:** [@Josh\_A](https://discuss.elastic.co/u/Josh_A)\ **Replies:** 9\ **Last updated:** [May 28, 2021, 11:16am UTC](https://discuss.elastic.co/t/cant-uninstall-elastic-endpoint-on-macos/273986 "2021-05-28T11:16:57Z")
Hi - the macOS agent is a huge CPU and RAM hog on macOS 11.2.3. I'm trying to uninstall following these instructions: When I browse to the folder where the endpoint is installed (/Library/Elastic/Endpoint/), I get the… --- ## [Timeline result of events not showing](https://discuss.elastic.co/t/timeline-result-of-events-not-showing/273930)
**Author:** [@Kupauw](https://discuss.elastic.co/u/Kupauw)\ **Replies:** 8\ **Last updated:** [May 27, 2021, 8:54pm UTC](https://discuss.elastic.co/t/timeline-result-of-events-not-showing/273930 "2021-05-27T20:54:38Z")
Hi everyone. Today i upgraded my ELK stack to 7.12.1 and everything seems to be working fine except for the SIEM timeline. I ingest logs from Cisco FTD firewalls, F5 loadbalancers and our infoblox (DHCP/DNS). When i s… [Previous page](https://discuss.elastic.co/c/security/83.md?page=44) [Next page](https://discuss.elastic.co/c/security/83.md?page=46)