# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=48 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 49 --- ## [Exceptions GUI Improvements](https://discuss.elastic.co/t/exceptions-gui-improvements/270883)
**Author:** [@chris.murray](https://discuss.elastic.co/u/chris.murray)\ **Replies:** 1\ **Last updated:** [April 25, 2021, 5:55am UTC](https://discuss.elastic.co/t/exceptions-gui-improvements/270883 "2021-04-25T05:55:45Z")
I'm curious if there are any future enhancement plans for the Exceptions feature. Our SOC folks are finding a few limitations in managing them through the Kibana UI. Here are few examples of actions that can only be pe… --- ## [Correlation rules not working](https://discuss.elastic.co/t/correlation-rules-not-working/271147)
**Author:** [@Nil\_Battey\_Sannata](https://discuss.elastic.co/u/Nil_Battey_Sannata)\ **Replies:** 0\ **Last updated:** [April 24, 2021, 2:35pm UTC](https://discuss.elastic.co/t/correlation-rules-not-working/271147 "2021-04-24T14:35:46Z")
I was trying to test some of the prebuilt elastic detection rules with my Beat-Elasticsearch-Kibana setup. All other rules with simple query was working but the rules with event correlation was not working. I tried all p… --- ## [Detection result in new Index](https://discuss.elastic.co/t/detection-result-in-new-index/270347)
**Author:** [@xahmi](https://discuss.elastic.co/u/xahmi)\ **Replies:** 5\ **Last updated:** [April 23, 2021, 5:05pm UTC](https://discuss.elastic.co/t/detection-result-in-new-index/270347 "2021-04-23T17:05:43Z")
Hi, is there a way to save the custom query Job results/anomalies in a new Index? I think we can do that with ML but is there a way to do the same with other detection types like Custom query , Threshold, Event Correla… --- ## [ML Job](https://discuss.elastic.co/t/ml-job/270906)
**Author:** [@Cosmin\_Ciobanu1](https://discuss.elastic.co/u/Cosmin_Ciobanu1)\ **Replies:** 2\ **Last updated:** [April 22, 2021, 7:45pm UTC](https://discuss.elastic.co/t/ml-job/270906 "2021-04-22T19:45:46Z")
Hi! I've created a machine learning job from scratch and, now, when I want to create a detection rules for this job, I cannot see it in that list. I have one node where can be opened 20 jobs, but it is the only one act… --- ## [Alerts from prebuilt detection rules](https://discuss.elastic.co/t/alerts-from-prebuilt-detection-rules/270633)
**Author:** [@NightSpark](https://discuss.elastic.co/u/NightSpark)\ **Replies:** 2\ **Last updated:** [April 21, 2021, 2:30am UTC](https://discuss.elastic.co/t/alerts-from-prebuilt-detection-rules/270633 "2021-04-21T02:30:19Z")
Hi, I am running 7.12 and would like to send an alerts to slack whenever a positive match occurs on one of the prebuilt detection rules. i.e Prebuilt rule reference | Elastic Security Solution \[7.12\] | Elastic I can s… --- ## [Send index information to Jira when a detection is triggered](https://discuss.elastic.co/t/send-index-information-to-jira-when-a-detection-is-triggered/270404)
**Author:** [@Felipe\_Fuller](https://discuss.elastic.co/u/Felipe_Fuller)\ **Replies:** 3\ **Last updated:** [April 20, 2021, 4:37pm UTC](https://discuss.elastic.co/t/send-index-information-to-jira-when-a-detection-is-triggered/270404 "2021-04-20T16:37:09Z")
Hi, community! I hope you're doing great! I'm struggling with some issues to send the correct information to Jira in rule actions. When I configure a new detection, I want to send some fields of the detection that are … --- ## [Detection rule CLI error](https://discuss.elastic.co/t/detection-rule-cli-error/270333)
**Author:** [@Nil\_Battey\_Sannata](https://discuss.elastic.co/u/Nil_Battey_Sannata)\ **Replies:** 1\ **Last updated:** [April 19, 2021, 7:59am UTC](https://discuss.elastic.co/t/detection-rule-cli-error/270333 "2021-04-19T07:59:31Z")
Hi, I am trying to import Detection RUles with CLI but facing errors as per attached snapshot. I am using self signed cert. --- ## [Help me writing watcher Query](https://discuss.elastic.co/t/help-me-writing-watcher-query/270103)
**Author:** [@abhishek\_s1](https://discuss.elastic.co/u/abhishek_s1)\ **Replies:** 5\ **Last updated:** [April 16, 2021, 11:47am UTC](https://discuss.elastic.co/t/help-me-writing-watcher-query/270103 "2021-04-16T11:47:39Z")
Hello, We are defining an activity of user to be suspicious if he logs in after very long period (1 month). So, I need to find if there exists a log entry or request with some username whose last request was \>= 1 month… --- ## [Is it possible to use regexp or wildcard when adding exception to detection rules?](https://discuss.elastic.co/t/is-it-possible-to-use-regexp-or-wildcard-when-adding-exception-to-detection-rules/270204)
**Author:** [@buzzdeee](https://discuss.elastic.co/u/buzzdeee)\ **Replies:** 2\ **Last updated:** [April 15, 2021, 8:22pm UTC](https://discuss.elastic.co/t/is-it-possible-to-use-regexp-or-wildcard-when-adding-exception-to-detection-rules/270204 "2021-04-15T20:22:02Z")
Hi, when adding exceptions to detection rules, is it possible to use regular expressions or wildcards? sometimes executable are started in directories created with random names, or have parameters with other variable p… --- ## [Email Action for Detection Rule](https://discuss.elastic.co/t/email-action-for-detection-rule/270270)
**Author:** [@Cosmin\_Ciobanu1](https://discuss.elastic.co/u/Cosmin_Ciobanu1)\ **Replies:** 2\ **Last updated:** [April 15, 2021, 7:12pm UTC](https://discuss.elastic.co/t/email-action-for-detection-rule/270270 "2021-04-15T19:12:41Z")
Hi! I wonder if it is possible to change the format of email action using a little bit of html or something close to it. Is there any option? Thank you! --- ## [Detections coverage of ATT&CK documentation](https://discuss.elastic.co/t/detections-coverage-of-att-ck-documentation/269692)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 3\ **Last updated:** [April 15, 2021, 5:57pm UTC](https://discuss.elastic.co/t/detections-coverage-of-att-ck-documentation/269692 "2021-04-15T17:57:24Z")
Hi, We are trying to review the ATT&CK coverage for the current detections to help us with creation and coverage of our own ruleset, is there anything available for us to use? Thanks --- ## [Valuelists in EQL (correlation) & Threshold Rules](https://discuss.elastic.co/t/valuelists-in-eql-correlation-threshold-rules/268355)
**Author:** [@tushar.bansal](https://discuss.elastic.co/u/tushar.bansal)\ **Replies:** 2\ **Last updated:** [April 15, 2021, 4:31pm UTC](https://discuss.elastic.co/t/valuelists-in-eql-correlation-threshold-rules/268355 "2021-04-15T16:31:25Z")
Why Can't we add value lists as condition in Correlation Rule Type & Threshold Rule Types even in 7.12? We can only add value lists in indicator match type rules. Why? --- ## [SIEM Detection rule reload](https://discuss.elastic.co/t/siem-detection-rule-reload/270045)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 4\ **Last updated:** [April 14, 2021, 10:07pm UTC](https://discuss.elastic.co/t/siem-detection-rule-reload/270045 "2021-04-14T22:07:21Z")
Due to a rather nasty upgrade that resulted in a bugs. One of which is every SIEM rule no longer works each one has a different reason so going 1 by 1 isn't really an option. Is it possible to wipe and reload all rules … --- ## [Issues with Elastic Agent and Defender?](https://discuss.elastic.co/t/issues-with-elastic-agent-and-defender/269818)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 6\ **Last updated:** [April 13, 2021, 5:27pm UTC](https://discuss.elastic.co/t/issues-with-elastic-agent-and-defender/269818 "2021-04-13T17:27:09Z")
After an upgrade to 7.12, a few machines experience high CPU load from Elastic endpoint security. The load seems to be periodic: The three processes/services that seem to cause this load are Elastic Endpoint, MS D… --- ## [An error occurred during rule execution](https://discuss.elastic.co/t/an-error-occurred-during-rule-execution/269536)
**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Replies:** 1\ **Last updated:** [April 13, 2021, 2:06pm UTC](https://discuss.elastic.co/t/an-error-occurred-during-rule-execution/269536 "2021-04-13T14:06:31Z")
I've been getting this error on all of my Machine Learning Rules. --- ## [Watchers and Elastic Security](https://discuss.elastic.co/t/watchers-and-elastic-security/268360)
**Author:** [@Anna\_Foxx](https://discuss.elastic.co/u/Anna_Foxx)\ **Replies:** 1\ **Last updated:** [April 13, 2021, 11:01am UTC](https://discuss.elastic.co/t/watchers-and-elastic-security/268360 "2021-04-13T11:01:28Z")
Hi! I have a lot of detections on my watchers. Is it possible to have the alert generated by watchers in the Detection section of Elastic Security SIEM? --- ## [DDoS attach detection using Elastic stack](https://discuss.elastic.co/t/ddos-attach-detection-using-elastic-stack/258984)
**Author:** [@atharvak](https://discuss.elastic.co/u/atharvak)\ **Replies:** 1\ **Last updated:** [April 13, 2021, 10:54am UTC](https://discuss.elastic.co/t/ddos-attach-detection-using-elastic-stack/258984 "2021-04-13T10:54:49Z")
Hello all, I am currently using Elastic stack to parse Apache and Nginx web logs with Filebeat installed on multiple remote servers shipping logs to my Elastic server. I want to use the same infrastructure to be able to… --- ## [Event Correlation detection - tiebreaker field](https://discuss.elastic.co/t/event-correlation-detection-tiebreaker-field/269974)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 0\ **Last updated:** [April 13, 2021, 8:12am UTC](https://discuss.elastic.co/t/event-correlation-detection-tiebreaker-field/269974 "2021-04-13T08:12:10Z")
Hi, I need to use a tiebreaker field within an Event Correlation detection rule, I cannot find in the docs other than for a query, hoping its possible somehow Thanks --- ## [Detection-Rules - Subtechniques](https://discuss.elastic.co/t/detection-rules-subtechniques/269658)
**Author:** [@inf](https://discuss.elastic.co/u/inf)\ **Replies:** 3\ **Last updated:** [April 13, 2021, 1:47am UTC](https://discuss.elastic.co/t/detection-rules-subtechniques/269658 "2021-04-13T01:47:59Z")
As I understand from the official GitHub repository for detection-rules, sub-techniques are already used as part of the existing rules. One example can be found here. However, from what I see in the latest guide, it is … --- ## [Value Lists as Exception in Threshold and Correlation type rules](https://discuss.elastic.co/t/value-lists-as-exception-in-threshold-and-correlation-type-rules/268353)
**Author:** [@tushar.bansal](https://discuss.elastic.co/u/tushar.bansal)\ **Replies:** 1\ **Last updated:** [April 13, 2021, 1:20am UTC](https://discuss.elastic.co/t/value-lists-as-exception-in-threshold-and-correlation-type-rules/268353 "2021-04-13T01:20:53Z")
Why Can't we add value list as exception for Threshold rules and correlation rules even in 7.12? --- ## ["Azure Excessive Signin Logs by Azure Identity" unusable azure.signinlogs.identity](https://discuss.elastic.co/t/azure-excessive-signin-logs-by-azure-identity-unusable-azure-signinlogs-identity/269708)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [April 12, 2021, 9:55pm UTC](https://discuss.elastic.co/t/azure-excessive-signin-logs-by-azure-identity-unusable-azure-signinlogs-identity/269708 "2021-04-12T21:55:03Z")
Hello, Just noticed that in the rule "Azure Excessive Signin Logs by Azure Identity" it seems impossible to display the field azure.signinlogs.identity, which is not very user friendly and a waste of time to lookup afte… --- ## [Generate a Detection when new document is indexed](https://discuss.elastic.co/t/generate-a-detection-when-new-document-is-indexed/268140)
**Author:** [@Felipe\_Fuller](https://discuss.elastic.co/u/Felipe_Fuller)\ **Replies:** 7\ **Last updated:** [April 9, 2021, 6:02pm UTC](https://discuss.elastic.co/t/generate-a-detection-when-new-document-is-indexed/268140 "2021-04-09T18:02:16Z")
Hi Community, I'm trying to generate a detection over time with Elastic SIEM. Giving more context, I'm indexing, through Logstash, data from an API rest, so every half an hour I receive new data. Mostly, is repeated dat… --- ## [Deleting a space-agnostic exception container](https://discuss.elastic.co/t/deleting-a-space-agnostic-exception-container/269640)
**Author:** [@gplourde](https://discuss.elastic.co/u/gplourde)\ **Replies:** 1\ **Last updated:** [April 9, 2021, 12:27pm UTC](https://discuss.elastic.co/t/deleting-a-space-agnostic-exception-container/269640 "2021-04-09T12:27:07Z")
How do you delete an exception container that is space agnostic? "namespace\_type": "agnostic" If I try to delete it using the Exceptions API I get an error stating the list does not exist. { "message": "exce… --- ## [Unable to use SIEM module](https://discuss.elastic.co/t/unable-to-use-siem-module/268033)
**Author:** [@new2\_elk](https://discuss.elastic.co/u/new2_elk)\ **Replies:** 10\ **Last updated:** [April 8, 2021, 11:33am UTC](https://discuss.elastic.co/t/unable-to-use-siem-module/268033 "2021-04-08T11:33:26Z")
Hi All, I have setup a lab environment with below configuration: Lab firewall sending log -\> (Filebeat -\> Logstash -\> Elasticsearch) which Fliebeat, logstash, Elasticsearch is on Alibaba Cloud. When I try to use the S… --- ## [The following indices are missing the timestamp override field "event.ingested"](https://discuss.elastic.co/t/the-following-indices-are-missing-the-timestamp-override-field-event-ingested/269532)
**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Replies:** 0\ **Last updated:** [April 7, 2021, 10:46pm UTC](https://discuss.elastic.co/t/the-following-indices-are-missing-the-timestamp-override-field-event-ingested/269532 "2021-04-07T22:46:31Z")
How do I fix this? --- ## [Detection-rules](https://discuss.elastic.co/t/detection-rules/269219)
**Author:** [@dddddddddddddddd](https://discuss.elastic.co/u/dddddddddddddddd)\ **Replies:** 8\ **Last updated:** [April 7, 2021, 4:26pm UTC](https://discuss.elastic.co/t/detection-rules/269219 "2021-04-07T16:26:26Z")
Hi, i hope this message finds you well , so how to add the project elastic/detection-rules to my elk stack regards and thanks --- ## [Elastic Agent stopped sending certain data streams](https://discuss.elastic.co/t/elastic-agent-stopped-sending-certain-data-streams/267109)
**Author:** [@The1WhoPrtNocks](https://discuss.elastic.co/u/The1WhoPrtNocks)\ **Replies:** 5\ **Last updated:** [April 6, 2021, 2:44pm UTC](https://discuss.elastic.co/t/elastic-agent-stopped-sending-certain-data-streams/267109 "2021-04-06T14:44:55Z")
Hi, I have deployed the agent along with the windows intergration. As part of this I wanted to collect Powershell logs. This was working fine however at 20:31:49.750 yestarday I received my last powershell log on the "… --- ## [How to create a rule with aggregation](https://discuss.elastic.co/t/how-to-create-a-rule-with-aggregation/269023)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 4\ **Last updated:** [April 6, 2021, 7:57am UTC](https://discuss.elastic.co/t/how-to-create-a-rule-with-aggregation/269023 "2021-04-06T07:57:22Z")
Hello, I would like to create a rule where I can detect brute force attack For example: in winlogbeat-\* and auditbeat-\* where event.action == logon-failed, aggregation by user.name , and if it's more than 10, it creat… --- ## [ElasticSearch SAML license requirement?](https://discuss.elastic.co/t/elasticsearch-saml-license-requirement/269257)
**Author:** [@ehfdub](https://discuss.elastic.co/u/ehfdub)\ **Replies:** 2\ **Last updated:** [April 5, 2021, 8:18pm UTC](https://discuss.elastic.co/t/elasticsearch-saml-license-requirement/269257 "2021-04-05T20:18:18Z")
Hello, I'm looking to implement SAML single-signon in ELK stack. I've been following this guide Configuring SAML single-sign-on on the Elastic Stack | Elasticsearch Guide \[7.12\] | Elastic. The guide does not mention a… --- ## [Possible bug with Elastic Agent ca certificate checks](https://discuss.elastic.co/t/possible-bug-with-elastic-agent-ca-certificate-checks/267253)
**Author:** [@finbarr996](https://discuss.elastic.co/u/finbarr996)\ **Replies:** 10\ **Last updated:** [April 5, 2021, 11:34am UTC](https://discuss.elastic.co/t/possible-bug-with-elastic-agent-ca-certificate-checks/267253 "2021-04-05T11:34:48Z")
Hi there, TL;DR: The endpoint agent can't talk to ES as it doesn't trust the self signed ca cert, despite this being in the trusted root store of the endpoint. The workaround: The agent requires a path to be defined in… [Previous page](https://discuss.elastic.co/c/security/83.md?page=47) [Next page](https://discuss.elastic.co/c/security/83.md?page=49)