# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=46 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 47 --- ## [Osquery Manager Feedback - Live Query - All Agents](https://discuss.elastic.co/t/osquery-manager-feedback-live-query-all-agents/274001)
**Author:** [@n3k0](https://discuss.elastic.co/u/n3k0)\ **Replies:** 2\ **Last updated:** [May 26, 2021, 7:39pm UTC](https://discuss.elastic.co/t/osquery-manager-feedback-live-query-all-agents/274001 "2021-05-26T19:39:53Z")
I upgraded from 7.12 to 7.13 and all of my previous fleet agents were automatically unenrolled. Which is cool. However, when I run a live query and select "All Agents", it shows as if it's going to query the five enroll… --- ## [Osquery Manager Feedback - Linux AARCH64 - Raspberry Pi](https://discuss.elastic.co/t/osquery-manager-feedback-linux-aarch64-raspberry-pi/274003)
**Author:** [@n3k0](https://discuss.elastic.co/u/n3k0)\ **Replies:** 1\ **Last updated:** [May 26, 2021, 12:59pm UTC](https://discuss.elastic.co/t/osquery-manager-feedback-linux-aarch64-raspberry-pi/274003 "2021-05-26T12:59:18Z")
I used Linux AARCH64 successfully to install the elastic agent on two of my raspberry pi's. Which is fantastic. I wasn't expecting it to work. However, osquery searches don't appear to be working against both raspberry … --- ## [SIEM timeline cant be saved](https://discuss.elastic.co/t/siem-timeline-cant-be-saved/273963)
**Author:** [@Shubhangi](https://discuss.elastic.co/u/Shubhangi)\ **Replies:** 3\ **Last updated:** [May 25, 2021, 8:31pm UTC](https://discuss.elastic.co/t/siem-timeline-cant-be-saved/273963 "2021-05-25T20:31:38Z")
I'm using ELK v7.8 How to save SIEM timelines? The autosave feature mentioned in the blogs/doc can not be seen for me. DO I need to enable something? I'm super user with all the access --- ## [Failed to deploy Endpoint on Windows Server 2008 R2 Standard](https://discuss.elastic.co/t/failed-to-deploy-endpoint-on-windows-server-2008-r2-standard/273704)
**Author:** [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Replies:** 7\ **Last updated:** [May 24, 2021, 8:14pm UTC](https://discuss.elastic.co/t/failed-to-deploy-endpoint-on-windows-server-2008-r2-standard/273704 "2021-05-24T20:14:13Z")
Hi, Notes: Running ELK 7.11.2 Standalone OS Windows Server 2008 R2 Standard I am deploying the Elastic Endpoint on several servers. On servers running OS Windows Server 2012 R2 Datacenter and Windows Server 2019 Data… --- ## [Additional Variable adding in Detection EMAIL body](https://discuss.elastic.co/t/additional-variable-adding-in-detection-email-body/273290)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 4\ **Last updated:** [May 23, 2021, 10:14am UTC](https://discuss.elastic.co/t/additional-variable-adding-in-detection-email-body/273290 "2021-05-23T10:14:25Z")
Hi, I am trying to add additional fields in EMAIL message in my detection email alert action. {{#context.alerts}} Message : {{message}} port: {{port}} URL Host : {{url.host}} Http Connect: {{http.connect.host}} {… --- ## [Detection Rule Key Value Reference Url's](https://discuss.elastic.co/t/detection-rule-key-value-reference-urls/272466)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 5\ **Last updated:** [May 22, 2021, 5:23pm UTC](https://discuss.elastic.co/t/detection-rule-key-value-reference-urls/272466 "2021-05-22T17:23:17Z")
Hello, After working intensively with Elastic Detections and alerting etc, I wanted to suggest that imho it would be an improvement if the reference url's were key / value instead of only the url's. Sometimes the url's … --- ## [Logstash and filebeat](https://discuss.elastic.co/t/logstash-and-filebeat/273614)
**Author:** [@Francisco\_Ramirez](https://discuss.elastic.co/u/Francisco_Ramirez)\ **Replies:** 1\ **Last updated:** [May 21, 2021, 10:52pm UTC](https://discuss.elastic.co/t/logstash-and-filebeat/273614 "2021-05-21T22:52:50Z")
Hi Folks I configured elasticsearch and kibana for visualizate event from wazuh, now i want see this event into the module siem. best regards --- ## [Failed to connect to backoff(elasticsearch](https://discuss.elastic.co/t/failed-to-connect-to-backoff-elasticsearch/273424)
**Author:** [@noraben](https://discuss.elastic.co/u/noraben)\ **Replies:** 1\ **Last updated:** [May 21, 2021, 10:06am UTC](https://discuss.elastic.co/t/failed-to-connect-to-backoff-elasticsearch/273424 "2021-05-21T10:06:05Z")
Hello, I have some issues with agents enrollement. My agents are enrolled using a policy with Endpoint integration. The issue is that these agents display no logs message, and do not appear in Administration tab (a stuc… --- ## [SIEM mail format for winevent log](https://discuss.elastic.co/t/siem-mail-format-for-winevent-log/273632)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 0\ **Last updated:** [May 21, 2021, 7:54am UTC](https://discuss.elastic.co/t/siem-mail-format-for-winevent-log/273632 "2021-05-21T07:54:52Z")
Hi a. The mail format for elastic siem was a little weird for me at this point. For most case the mail got the right format out to me but on the case of winevent log it is a bit difference. when i try the {{winlog.eve… --- ## [Format mail send from siem detection threshold rule](https://discuss.elastic.co/t/format-mail-send-from-siem-detection-threshold-rule/273375)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 2\ **Last updated:** [May 20, 2021, 1:37am UTC](https://discuss.elastic.co/t/format-mail-send-from-siem-detection-threshold-rule/273375 "2021-05-20T01:37:34Z")
Hi all I have successfully config for siem to send alert mail and now when i tried it with the theashold rule it failed. So i want to ask how to format theashold rule mail to send infomation. The format that i tried i… --- ## [Unable to add Cisco integration under Fleet Policy](https://discuss.elastic.co/t/unable-to-add-cisco-integration-under-fleet-policy/273121)
**Author:** [@Shiv18](https://discuss.elastic.co/u/Shiv18)\ **Replies:** 1\ **Last updated:** [May 19, 2021, 3:35pm UTC](https://discuss.elastic.co/t/unable-to-add-cisco-integration-under-fleet-policy/273121 "2021-05-19T15:35:19Z")
Hi Team, I'm using Elastic agent for endpoint, servers and network devices. I can able to add policy for endpoints but for network Cisco integration alone throws me error. I'm trying to add this through Fleet policy for… --- ## [SIEM created and closed cases report](https://discuss.elastic.co/t/siem-created-and-closed-cases-report/270931)
**Author:** [@bnk](https://discuss.elastic.co/u/bnk)\ **Replies:** 9\ **Last updated:** [May 19, 2021, 9:53am UTC](https://discuss.elastic.co/t/siem-created-and-closed-cases-report/270931 "2021-05-19T09:53:21Z")
Hello, I looked information if there is a possibility to export info about created and closed cases (also tags associated with cases and other related info) in ELK SIEM, but I coudn't find any information. Is there a way… --- ## [Elastic endpoint is not sending to TLS protected cluster](https://discuss.elastic.co/t/elastic-endpoint-is-not-sending-to-tls-protected-cluster/273080)
**Author:** [@Bert\_Colemont](https://discuss.elastic.co/u/Bert_Colemont)\ **Replies:** 3\ **Last updated:** [May 18, 2021, 3:52pm UTC](https://discuss.elastic.co/t/elastic-endpoint-is-not-sending-to-tls-protected-cluster/273080 "2021-05-18T15:52:18Z")
Hi all, I have managed to setup an elastic cluster with 3 nodes. Kibana is running on node-1 Now I installed the elastic endpoint agent to my windows machine. .\\elastic-agent.exe install -f --kibana-url=http://elasti… --- ## [Replay rule on old index dates](https://discuss.elastic.co/t/replay-rule-on-old-index-dates/272857)
**Author:** [@priamai](https://discuss.elastic.co/u/priamai)\ **Replies:** 9\ **Last updated:** [May 18, 2021, 2:56pm UTC](https://discuss.elastic.co/t/replay-rule-on-old-index-dates/272857 "2021-05-18T14:56:34Z")
Hi there, I have 90 days worth of windows event logs (partitioned per day) and a set of rules that I want to apply on those days. I noticed that when I activate a rule it can only go forward in time, is there a way to … --- ## [7.12.1 threshold rule, group by field within actions](https://discuss.elastic.co/t/7-12-1-threshold-rule-group-by-field-within-actions/272209)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 5\ **Last updated:** [May 18, 2021, 2:43pm UTC](https://discuss.elastic.co/t/7-12-1-threshold-rule-group-by-field-within-actions/272209 "2021-05-18T14:43:09Z")
Hi, With 7.12.1 i can see our group by field appearing in the detection event, in this case it is host.name. I have tried pushing through within the actions but it is still empty. I am trying to access this data in se… --- ## [Elastic-Agent send logs but Status Offline](https://discuss.elastic.co/t/elastic-agent-send-logs-but-status-offline/273168)
**Author:** [@Halim\_Bourtala](https://discuss.elastic.co/u/Halim_Bourtala)\ **Replies:** 0\ **Last updated:** [May 17, 2021, 11:36am UTC](https://discuss.elastic.co/t/elastic-agent-send-logs-but-status-offline/273168 "2021-05-17T11:36:38Z")
Hello Elastic team, I am testing elastic agent and we are facing an issue/bug not documented in fleet troubleshooting article, this is why I would like to learn how to Troubleshoot elastic-agent communication with Fleet… --- ## [EQL - Network Port scan - Watcher to EQL](https://discuss.elastic.co/t/eql-network-port-scan-watcher-to-eql/273104)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 2\ **Last updated:** [May 18, 2021, 11:52am UTC](https://discuss.elastic.co/t/eql-network-port-scan-watcher-to-eql/273104 "2021-05-18T11:52:01Z")
Please help me to convert the below port scan watcher query to EQL in ELK SIEM 7.12.1. PUT \_watcher/watch/port\_scan\_watch { "trigger": { "schedule": { "interval": "10s" } }, "input": { "search": { "request": { … --- ## [Detect Horizontal Port Scan](https://discuss.elastic.co/t/detect-horizontal-port-scan/272710)
**Author:** [@pmorenosi](https://discuss.elastic.co/u/pmorenosi)\ **Replies:** 1\ **Last updated:** [May 18, 2021, 11:23am UTC](https://discuss.elastic.co/t/detect-horizontal-port-scan/272710 "2021-05-18T11:23:09Z")
Hello everyone, From the logs that I have stored in Elasticsearch from a Firewall, I need to detect a type of attack called "Horizontal Port Scan" that is defined as follows: Unique source IP address that has "N" differ… --- ## [UDP packets cover 50% of packetbeat logs](https://discuss.elastic.co/t/udp-packets-cover-50-of-packetbeat-logs/272689)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 7\ **Last updated:** [May 18, 2021, 8:34am UTC](https://discuss.elastic.co/t/udp-packets-cover-50-of-packetbeat-logs/272689 "2021-05-18T08:34:24Z")
Hi, I can see that 50% of my packetbeat logs are from network.transport: udp . In terms of SIEM perspective do I need this types of logs in kibana? (I don't use any VOIP or streaming services on my monitored machine.) … --- ## [Threat hunting with suricata, ElasticSecurity](https://discuss.elastic.co/t/threat-hunting-with-suricata-elasticsecurity/273148)
**Author:** [@111387](https://discuss.elastic.co/u/111387)\ **Replies:** 1\ **Last updated:** [May 17, 2021, 11:51pm UTC](https://discuss.elastic.co/t/threat-hunting-with-suricata-elasticsecurity/273148 "2021-05-17T23:51:07Z")
Good morning. I have built a suricata, and I am delivering events to elasticsearch with filebeat. There are various detection rules in elasticsecurity, but among them, detection rules for suricata (ET Rule) do not exis… --- ## [Elastic Endpoint Security - Unkown Internet Connections](https://discuss.elastic.co/t/elastic-endpoint-security-unkown-internet-connections/272999)
**Author:** [@RafnexJr](https://discuss.elastic.co/u/RafnexJr)\ **Replies:** 1\ **Last updated:** [May 14, 2021, 6:00pm UTC](https://discuss.elastic.co/t/elastic-endpoint-security-unkown-internet-connections/272999 "2021-05-14T18:00:26Z")
Hi everyone, I deployed an Elastic Stack with Endpoint Security in my Lab and now I looked at the communication and some communication is clear to me, like: telemetry.elastic\[.\]co epr.elastic\[.\]co artifacts.security.… --- ## [Detection Rule Exceptions "is one of", comma in value](https://discuss.elastic.co/t/detection-rule-exceptions-is-one-of-comma-in-value/272738)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 6\ **Last updated:** [May 12, 2021, 8:30pm UTC](https://discuss.elastic.co/t/detection-rule-exceptions-is-one-of-comma-in-value/272738 "2021-05-12T20:30:45Z")
Hi All, I'm trying to add an exception to a detection rule. This exception is intended to be an is one of rule, that excludes a number of ISPs. However, I am running into an issue some of the ISP names contain a comma, … --- ## [Format SIEM alerts](https://discuss.elastic.co/t/format-siem-alerts/272772)
**Author:** [@vishnug](https://discuss.elastic.co/u/vishnug)\ **Replies:** 2\ **Last updated:** [May 12, 2021, 6:46pm UTC](https://discuss.elastic.co/t/format-siem-alerts/272772 "2021-05-12T18:46:50Z")
Hi, I'm using ELK v7.12.1. I have enabled few SIEM rules and configured an email action. I'm able to access the event details through {{#context.alerts}} {{.}}{{/context.alerts}}. But when sending the mail the content … --- ## [EQL Sequence doesn't correlate events having same exact timestamp?](https://discuss.elastic.co/t/eql-sequence-doesnt-correlate-events-having-same-exact-timestamp/271845)
**Author:** [@hilo21](https://discuss.elastic.co/u/hilo21)\ **Replies:** 4\ **Last updated:** [May 12, 2021, 9:02am UTC](https://discuss.elastic.co/t/eql-sequence-doesnt-correlate-events-having-same-exact-timestamp/271845 "2021-05-12T09:02:31Z")
Hello, I was trying to hunt for a specific behavior with EQL sequences and I have a question. If events have the same exact timestamp EQL won't work. Here is an example EQL Query : sequence by winlog.event\_data.Targe… --- ## [How to write a kibana rule with filename](https://discuss.elastic.co/t/how-to-write-a-kibana-rule-with-filename/272673)
**Author:** [@realtech2338](https://discuss.elastic.co/u/realtech2338)\ **Replies:** 1\ **Last updated:** [May 12, 2021, 1:14am UTC](https://discuss.elastic.co/t/how-to-write-a-kibana-rule-with-filename/272673 "2021-05-12T01:14:05Z")
I would like to write a rule to detect if the file name & path are matching for china chopper webshells from below list. for entire csv What is the best way to do please guide me with exact steps. I know we need creat… --- ## [Display the DNS of the visiting IP](https://discuss.elastic.co/t/display-the-dns-of-the-visiting-ip/272174)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 6\ **Last updated:** [May 11, 2021, 10:38am UTC](https://discuss.elastic.co/t/display-the-dns-of-the-visiting-ip/272174 "2021-05-11T10:38:40Z")
Hi, In SEIM I can see the DNS requests coming out from my machine. Like when I'm visiting google it is logged here in SIEM --\> Network --\> DNS I need the contrary, How can I see the DNS of the IP's visiting my machin… --- ## [False-positive](https://discuss.elastic.co/t/false-positive/272598)
**Author:** [@em3rals](https://discuss.elastic.co/u/em3rals)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 3:53pm UTC](https://discuss.elastic.co/t/false-positive/272598 "2021-05-10T15:53:30Z")
Hello, how is everything ? My name is Emerson, I work in the IT infrastructure sector at GAtec Gestão agroindustrial, I would like to report a FALSE POSITIVE in relation to an executable of our company. False positive wa… --- ## [Way to place new line space using Webhook request](https://discuss.elastic.co/t/way-to-place-new-line-space-using-webhook-request/272413)
**Author:** [@Suro](https://discuss.elastic.co/u/Suro)\ **Replies:** 1\ **Last updated:** [May 9, 2021, 8:38pm UTC](https://discuss.elastic.co/t/way-to-place-new-line-space-using-webhook-request/272413 "2021-05-09T20:38:43Z")
We are trying to call ServiceNow Webhook API calls via Elastic Security signal actions. For Eg, we are using the following body below - { "short\_description":"{{context.rule.name}}", "description":"""Rule Descri… --- ## [File Storage being swallowed up](https://discuss.elastic.co/t/file-storage-being-swallowed-up/271325)
**Author:** [@insurin](https://discuss.elastic.co/u/insurin)\ **Replies:** 7\ **Last updated:** [May 7, 2021, 6:08pm UTC](https://discuss.elastic.co/t/file-storage-being-swallowed-up/271325 "2021-05-07T18:08:17Z")
I have 1 agent running that has the 'Endpoint Security' and the 'System Integration'. This is running on a Windows file server and reporting into ELK which is running on Ubuntu. This one server is consuming 8gb data a da… --- ## [How to discard specific event from storing or correlation in SIEM to save resources](https://discuss.elastic.co/t/how-to-discard-specific-event-from-storing-or-correlation-in-siem-to-save-resources/271716)
**Author:** [@zoot](https://discuss.elastic.co/u/zoot)\ **Replies:** 1\ **Last updated:** [May 6, 2021, 11:02pm UTC](https://discuss.elastic.co/t/how-to-discard-specific-event-from-storing-or-correlation-in-siem-to-save-resources/271716 "2021-05-06T23:02:20Z")
Hi, In SIEM systems events can be discard or filter to safe diskspace and avoid overloading SIEM from noisy events. This way SIEM resources can be managed at optimum levels. For example windows event 5156 from all agen… [Previous page](https://discuss.elastic.co/c/security/83.md?page=45) [Next page](https://discuss.elastic.co/c/security/83.md?page=47)