# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=47 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 48 --- ## [Brute Force Detection Rule](https://discuss.elastic.co/t/brute-force-detection-rule/271713)
**Author:** [@filip.wozniak](https://discuss.elastic.co/u/filip.wozniak)\ **Replies:** 3\ **Last updated:** [May 6, 2021, 11:00pm UTC](https://discuss.elastic.co/t/brute-force-detection-rule/271713 "2021-05-06T23:00:32Z")
Greetings! I'm using WinlogBeats with configured Sysmon. I want to write my own rule: If any user in last 5 minutes failed to login 5 times, Detection should trigger. So I tried this: This is threshold rule, but I… --- ## [Create new issue in Jira for each event in a detection](https://discuss.elastic.co/t/create-new-issue-in-jira-for-each-event-in-a-detection/270744)
**Author:** [@Felipe\_Fuller](https://discuss.elastic.co/u/Felipe_Fuller)\ **Replies:** 10\ **Last updated:** [May 6, 2021, 10:52pm UTC](https://discuss.elastic.co/t/create-new-issue-in-jira-for-each-event-in-a-detection/270744 "2021-05-06T22:52:10Z")
Hi Community! I hope that you are doing great! I'm trying to send an issue per event in a detection, but I'm struggling to find any solution. So in this case, there should be 5 issues created in Jira. Thank you ver… --- ## [Can't access Detections from a different space](https://discuss.elastic.co/t/cant-access-detections-from-a-different-space/272118)
**Author:** [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Replies:** 9\ **Last updated:** [May 6, 2021, 8:55pm UTC](https://discuss.elastic.co/t/cant-access-detections-from-a-different-space/272118 "2021-05-06T20:55:49Z")
Hi, \*Running ELK 7.11.2 Standalone I am trying to setup a user to have access to Security in a separate space. I have been following all directions from the official documentation, but the user can't access the "Detect… --- ## [Turn on SIEM in Kibana 7.10.2](https://discuss.elastic.co/t/turn-on-siem-in-kibana-7-10-2/271346)
**Author:** [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)\ **Replies:** 4\ **Last updated:** [May 6, 2021, 1:15pm UTC](https://discuss.elastic.co/t/turn-on-siem-in-kibana-7-10-2/271346 "2021-05-06T13:15:25Z")
I was able to turn off / on SIEM in kibana 7.8.1 under spaces however this seems to be gone in 7.10.2 How can i enable SIEM in Kibana 7.10.2 ? 7.8.1 7.10.2 --- ## [Error: fail to communicate with updated API client hosts](https://discuss.elastic.co/t/error-fail-to-communicate-with-updated-api-client-hosts/270268)
**Author:** [@priamai](https://discuss.elastic.co/u/priamai)\ **Replies:** 1\ **Last updated:** [May 6, 2021, 1:02pm UTC](https://discuss.elastic.co/t/error-fail-to-communicate-with-updated-api-client-hosts/270268 "2021-05-06T13:02:04Z")
Hi there, I have installed the ElasticAgent on Ubuntu 18.04 LTS via the suggested commandline: sudo ./elastic-agent install -f --kibana-url=https://10.0.0.75:5601 --enrollment-token=cTZFSzFuZ0JrSlg2TXhjV1o0M1E6bUdzNVhF… --- ## [Find Cases API endpoint](https://discuss.elastic.co/t/find-cases-api-endpoint/271904)
**Author:** [@rpiccio](https://discuss.elastic.co/u/rpiccio)\ **Replies:** 1\ **Last updated:** [May 6, 2021, 2:05am UTC](https://discuss.elastic.co/t/find-cases-api-endpoint/271904 "2021-05-06T02:05:56Z")
Hi! I've been playing a bit with the Find Cases API endpoint but I'm unable to filter cases by any field other than status, reporters and tags. I've tried the Saved Objects filter parameter with lots of expresions to t… --- ## [Alert mail siem format question](https://discuss.elastic.co/t/alert-mail-siem-format-question/271849)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 1\ **Last updated:** [May 6, 2021, 1:15am UTC](https://discuss.elastic.co/t/alert-mail-siem-format-question/271849 "2021-05-06T01:15:50Z")
Hi all i have a question regarding elastic alert mail in siem. last time i get the test mail send was successfully parse the field to the mail. but this time i want to know that if the data that i have is not like json… --- ## [SIEM with Basic License On-Prem?](https://discuss.elastic.co/t/siem-with-basic-license-on-prem/272109)
**Author:** [@R99Stny](https://discuss.elastic.co/u/R99Stny)\ **Replies:** 1\ **Last updated:** [May 5, 2021, 12:56am UTC](https://discuss.elastic.co/t/siem-with-basic-license-on-prem/272109 "2021-05-05T00:56:27Z")
We have a 3 node cluster on prem 7.6. Couple questions: Based on the docs we should be able to see and use pre-built detections with only a basic license? We do need (required to) have tls/ssl set up within the cluster… --- ## [Rule exception in SIEM Kibana 7.12](https://discuss.elastic.co/t/rule-exception-in-siem-kibana-7-12/272072)
**Author:** [@dsgamr](https://discuss.elastic.co/u/dsgamr)\ **Replies:** 1\ **Last updated:** [May 4, 2021, 11:38pm UTC](https://discuss.elastic.co/t/rule-exception-in-siem-kibana-7-12/272072 "2021-05-04T23:38:22Z")
Hi, One of build in rules - Whoami Process Activity - generates a lot of false positives in my environment so I tried to add exception to the rule. Problem is that to do it properly one has to use wildcards which doesn… --- ## [Elastic Endopint fails deployment v7.12.1](https://discuss.elastic.co/t/elastic-endopint-fails-deployment-v7-12-1/271838)
**Author:** [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Replies:** 2\ **Last updated:** [May 4, 2021, 8:33pm UTC](https://discuss.elastic.co/t/elastic-endopint-fails-deployment-v7-12-1/271838 "2021-05-04T20:33:30Z")
Hi, Notes: ELK v7.12.1 Standalone OS Win 10 Pro, v20H2, build 19042.928 I recently upgraded to ELK v7.12.1 and have been testing it. Today I tried to update existing agents in Fleet to the most recent version. So far… --- ## [Elk stack docker with traefik](https://discuss.elastic.co/t/elk-stack-docker-with-traefik/271872)
**Author:** [@siara](https://discuss.elastic.co/u/siara)\ **Replies:** 1\ **Last updated:** [May 1, 2021, 10:03pm UTC](https://discuss.elastic.co/t/elk-stack-docker-with-traefik/271872 "2021-05-01T22:03:51Z")
Hi I have elk stack in docker with tls from documentation Running the Elastic Stack on Docker | Getting Started \[7.12\] | Elastic I try run this on server with traefik. I add traefik network for kibana container and add… --- ## [Endpoint Security Integration not working localhost](https://discuss.elastic.co/t/endpoint-security-integration-not-working-localhost/271807)
**Author:** [@cwobuzz](https://discuss.elastic.co/u/cwobuzz)\ **Replies:** 3\ **Last updated:** [April 30, 2021, 8:27pm UTC](https://discuss.elastic.co/t/endpoint-security-integration-not-working-localhost/271807 "2021-04-30T20:27:46Z")
I am using elastic-agent 7.12.1 and elasticsearch/kibana docker 7.12.1. Everything is running as https://0.0.0.0 Setup is here if needed: Setting-up-Docker-Elastic-Kibana-Running-Sysmon-And-Agent/.README.md at master · … --- ## [Index Alias in Elastic Security (Network Map) \[7.9.2\]](https://discuss.elastic.co/t/index-alias-in-elastic-security-network-map-7-9-2/271605)
**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\ **Replies:** 3\ **Last updated:** [April 30, 2021, 11:16am UTC](https://discuss.elastic.co/t/index-alias-in-elastic-security-network-map-7-9-2/271605 "2021-04-30T11:16:04Z")
Hi, everyone I have a SonicWall index (firewall device) that has the index alias Elastic Security. In Kibana --\> Advanced Settings --\> Elasticsearch indices -\> securitySolution:defaultIndex However, it does not wor… --- ## [Failed to fetch rules and timelines: Failed to parse field \[filter\]: x\_content\_parse\_exception](https://discuss.elastic.co/t/failed-to-fetch-rules-and-timelines-failed-to-parse-field-filter-x-content-parse-exception/269624)
**Author:** [@aditi\_salunke](https://discuss.elastic.co/u/aditi_salunke)\ **Replies:** 2\ **Last updated:** [April 29, 2021, 3:42pm UTC](https://discuss.elastic.co/t/failed-to-fetch-rules-and-timelines-failed-to-parse-field-filter-x-content-parse-exception/269624 "2021-04-29T15:42:03Z")
I am unable to find what went wrong. Can anyone help me out ? PS: 1)Not able to see pre-configured rules and customised one(for superuser role) 2)No alert is getting triggered --- ## [Detection Custom Rule not working](https://discuss.elastic.co/t/detection-custom-rule-not-working/269578)
**Author:** [@anaghadeoreofficial](https://discuss.elastic.co/u/anaghadeoreofficial)\ **Replies:** 7\ **Last updated:** [April 29, 2021, 3:41pm UTC](https://discuss.elastic.co/t/detection-custom-rule-not-working/269578 "2021-04-29T15:41:18Z")
We are unable to view custom alerts in the detection module. Showing error as below: --- ## [Watcher vs Detection Rule](https://discuss.elastic.co/t/watcher-vs-detection-rule/271564)
**Author:** [@cjumper](https://discuss.elastic.co/u/cjumper)\ **Replies:** 1\ **Last updated:** [April 29, 2021, 4:58am UTC](https://discuss.elastic.co/t/watcher-vs-detection-rule/271564 "2021-04-29T04:58:17Z")
Try to get a better understanding of the 2. Can someone explain to me the difference between a watcher and a detection rule? --- ## [Machine Learning Functions](https://discuss.elastic.co/t/machine-learning-functions/271404)
**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Replies:** 3\ **Last updated:** [April 28, 2021, 10:06pm UTC](https://discuss.elastic.co/t/machine-learning-functions/271404 "2021-04-28T22:06:12Z")
If i had a Datafeed that spammed multiple docs at once ( for example botnetalert, it triggered 20x ) What is the best function to use to just alert of that one event of all 20 events this is in a short period of course … --- ## [Threat Intel Module for Elastic cloud](https://discuss.elastic.co/t/threat-intel-module-for-elastic-cloud/271198)
**Author:** [@zoot](https://discuss.elastic.co/u/zoot)\ **Replies:** 7\ **Last updated:** [April 28, 2021, 4:15pm UTC](https://discuss.elastic.co/t/threat-intel-module-for-elastic-cloud/271198 "2021-04-28T16:15:00Z")
Hi, I am using Elastic Cloud for SEIM + Endpoint Security usecase. I want to integrate OTX as threat intel source but from the documentation it seems I need to use some different system instead of adding integration dir… --- ## [Creating a threshold based rule in the detection engine](https://discuss.elastic.co/t/creating-a-threshold-based-rule-in-the-detection-engine/270941)
**Author:** [@abhishek\_s1](https://discuss.elastic.co/u/abhishek_s1)\ **Replies:** 2\ **Last updated:** [April 28, 2021, 2:51pm UTC](https://discuss.elastic.co/t/creating-a-threshold-based-rule-in-the-detection-engine/270941 "2021-04-28T14:51:06Z")
I'm managing logs of a particular server, I'm defining an activity of a person with some username to be suspicious if there is sudden increase in their activity( i.e., user logs into server 100 times whereas on average h… --- ## [Create a rule to detect number of beats](https://discuss.elastic.co/t/create-a-rule-to-detect-number-of-beats/270366)
**Author:** [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\ **Replies:** 4\ **Last updated:** [April 28, 2021, 8:37am UTC](https://discuss.elastic.co/t/create-a-rule-to-detect-number-of-beats/270366 "2021-04-28T08:37:15Z")
Hello, I would like to create a new rule to detect if one of my beats stop sending data to my Cluster (one rule for each beat). For example I have installed packetbeat in 5 machines, and then the rule will verify each … --- ## [Normalizing usernames in executable paths to reduce "rare" detection noise?](https://discuss.elastic.co/t/normalizing-usernames-in-executable-paths-to-reduce-rare-detection-noise/271281)
**Author:** [@hukel](https://discuss.elastic.co/u/hukel)\ **Replies:** 1\ **Last updated:** [April 27, 2021, 5:00pm UTC](https://discuss.elastic.co/t/normalizing-usernames-in-executable-paths-to-reduce-rare-detection-noise/271281 "2021-04-27T17:00:40Z")
Is anyone "normalizing" executable or command line paths in the process schema? We see some noise in our rare detections for processes that run under the user's home drive. Considering changing "fred", "mary", "bob", a… --- ## [Ubuntu system log parsing](https://discuss.elastic.co/t/ubuntu-system-log-parsing/271293)
**Author:** [@Guncixx](https://discuss.elastic.co/u/Guncixx)\ **Replies:** 1\ **Last updated:** [April 27, 2021, 1:30am UTC](https://discuss.elastic.co/t/ubuntu-system-log-parsing/271293 "2021-04-27T01:30:35Z")
Hi, I’m new to Elastic and trying to explore it’s security capabilities. For the testing purpose I set up some VMs and installed elastic agent to collect logs. I then tried to generate some successful and some unsuccess… --- ## [Alerting on failed detection rules](https://discuss.elastic.co/t/alerting-on-failed-detection-rules/271300)
**Author:** [@Oliver2](https://discuss.elastic.co/u/Oliver2)\ **Replies:** 1\ **Last updated:** [April 27, 2021, 12:28am UTC](https://discuss.elastic.co/t/alerting-on-failed-detection-rules/271300 "2021-04-27T00:28:53Z")
Is it possible to create alerts based on detections rules that have failed for any reason. Ideally, it would fire into the detection queue? --- ## [Cases feature in Kibana](https://discuss.elastic.co/t/cases-feature-in-kibana/271075)
**Author:** [@cctk](https://discuss.elastic.co/u/cctk)\ **Replies:** 2\ **Last updated:** [April 26, 2021, 2:41pm UTC](https://discuss.elastic.co/t/cases-feature-in-kibana/271075 "2021-04-26T14:41:26Z")
Hi, I have a issue with the cases feature in Kibana Security section. I have created a timeline and I am trying to add any errors that I find as a case or to an existing case. However, it will not allow me to do this th… --- ## [Jira connector mapped to the wrong field](https://discuss.elastic.co/t/jira-connector-mapped-to-the-wrong-field/269535)
**Author:** [@kyles](https://discuss.elastic.co/u/kyles)\ **Replies:** 2\ **Last updated:** [April 26, 2021, 6:48am UTC](https://discuss.elastic.co/t/jira-connector-mapped-to-the-wrong-field/269535 "2021-04-26T06:48:38Z")
I setup the Jira connector to Elastic security but it automatically mapped the description field to a custom field that is not the description field. Is there a way to manually change what it is mapped to? --- ## [ServiceNow SIR Action Type Missing from Detection Configuration](https://discuss.elastic.co/t/servicenow-sir-action-type-missing-from-detection-configuration/270417)
**Author:** [@BrianD](https://discuss.elastic.co/u/BrianD)\ **Replies:** 1\ **Last updated:** [April 26, 2021, 6:33am UTC](https://discuss.elastic.co/t/servicenow-sir-action-type-missing-from-detection-configuration/270417 "2021-04-26T06:33:07Z")
The recent update to Elastic 7.12 included a new Connector for ServiceNow SIR creation. I setup the connector and proceeded to implement it as an Action for one of the SIEM Detection rules. However, when I go to select … --- ## [Missing "Host" and Event Log Data under Security tab](https://discuss.elastic.co/t/missing-host-and-event-log-data-under-security-tab/271183)
**Author:** [@mually](https://discuss.elastic.co/u/mually)\ **Replies:** 0\ **Last updated:** [April 25, 2021, 10:37am UTC](https://discuss.elastic.co/t/missing-host-and-event-log-data-under-security-tab/271183 "2021-04-25T10:37:46Z")
Hi, I deployed the elastic agent to my Windows server and enabled the endpoint security integration. The agent is visible and healthy from the fleet menu, and also from the administration page under the security menu. H… --- ## [Security not appear data](https://discuss.elastic.co/t/security-not-appear-data/271029)
**Author:** [@syafeera](https://discuss.elastic.co/u/syafeera)\ **Replies:** 2\ **Last updated:** [April 26, 2021, 12:50am UTC](https://discuss.elastic.co/t/security-not-appear-data/271029 "2021-04-26T00:50:03Z")
HI, may i know, why my data not display in security in kibana. Previously i'm using basic license. then i extend it to trial license. however, i saw my data for auditbeat and filebeat appear in discovery. but i just con… --- ## [ECS fields and ML jobs for modules loaded by process](https://discuss.elastic.co/t/ecs-fields-and-ml-jobs-for-modules-loaded-by-process/271188)
**Author:** [@hukel](https://discuss.elastic.co/u/hukel)\ **Replies:** 0\ **Last updated:** [April 25, 2021, 12:40pm UTC](https://discuss.elastic.co/t/ecs-fields-and-ml-jobs-for-modules-loaded-by-process/271188 "2021-04-25T12:40:55Z")
We want to run ML jobs for rare module loads in processes. From what I have seen, this is not in the ECS today, though I think it would be similar to process.args. Before we start creating custom fields and ML jobs, … --- ## [Elasticsearch Security - Asking for Data](https://discuss.elastic.co/t/elasticsearch-security-asking-for-data/271187)
**Author:** [@edvrfn](https://discuss.elastic.co/u/edvrfn)\ **Replies:** 1\ **Last updated:** [April 25, 2021, 2:51pm UTC](https://discuss.elastic.co/t/elasticsearch-security-asking-for-data/271187 "2021-04-25T14:51:13Z")
I am sending logs from my firewall/home-router(UDM) to rsyslog and copying the logs in Logstash directory. I can see the data in discover and can create visualizations/Dashboard from that data. But the security section i… [Previous page](https://discuss.elastic.co/c/security/83.md?page=46) [Next page](https://discuss.elastic.co/c/security/83.md?page=48)