# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=49 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 50 --- ## [SIEM (Kibana) not working with some errors](https://discuss.elastic.co/t/siem-kibana-not-working-with-some-errors/267657)
**Author:** [@Jose\_E](https://discuss.elastic.co/u/Jose_E)\ **Replies:** 1\ **Last updated:** [April 5, 2021, 10:20am UTC](https://discuss.elastic.co/t/siem-kibana-not-working-with-some-errors/267657 "2021-04-05T10:20:43Z")
I have the full ELK cluster experience with Filebeat sending logst to Logstash and there I do all my processing. I very recently learned that in order to have nested fields you should write "\[host\]\[name\]" rather than "ho… --- ## [SIgma rules for Elastic SIEM](https://discuss.elastic.co/t/sigma-rules-for-elastic-siem/268453)
**Author:** [@kmz161](https://discuss.elastic.co/u/kmz161)\ **Replies:** 4\ **Last updated:** [April 3, 2021, 4:42am UTC](https://discuss.elastic.co/t/sigma-rules-for-elastic-siem/268453 "2021-04-03T04:42:49Z")
Hello! I need to use Sigma rules repo for my SIEM. How I can translate sigma to elastic? And how I can perform auto update sigma rules? --- ## [Endpoint Security supported on ARM Linux (AARCH64)?](https://discuss.elastic.co/t/endpoint-security-supported-on-arm-linux-aarch64/269127)
**Author:** [@danmcq](https://discuss.elastic.co/u/danmcq)\ **Replies:** 2\ **Last updated:** [April 2, 2021, 6:21pm UTC](https://discuss.elastic.co/t/endpoint-security-supported-on-arm-linux-aarch64/269127 "2021-04-02T18:21:21Z")
I have been trying, unsuccessfully, to get Endpoint Security up and running on an ARM64 Ubuntu Linux 20.04 system. The elastic-agent is installed and working, but the Endpoint Security client never seems to download/inst… --- ## [Alert and connect mail format error](https://discuss.elastic.co/t/alert-and-connect-mail-format-error/268998)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 9\ **Last updated:** [April 2, 2021, 1:26pm UTC](https://discuss.elastic.co/t/alert-and-connect-mail-format-error/268998 "2021-04-02T13:26:14Z")
Hi all i have some question I was trying the version 7.12 for the first time, what interest me the most was that kibana finally have mail format for the siem rule, well i try cortext.alert just like how they show on gi… --- ## [Detection rules CLI](https://discuss.elastic.co/t/detection-rules-cli/268867)
**Author:** [@aditi\_salunke](https://discuss.elastic.co/u/aditi_salunke)\ **Replies:** 2\ **Last updated:** [April 1, 2021, 5:05pm UTC](https://discuss.elastic.co/t/detection-rules-cli/268867 "2021-04-01T17:05:20Z")
Traceback (most recent call last): File "/usr/lib64/python3.8/runpy.py", line 194, in \_run\_module\_as\_main return \_run\_code(code, main\_globals, None, File "/usr/lib64/python3.8/runpy.py", line 87, in \_run\_code … --- ## [Jira Action sending broken links on detection jobs](https://discuss.elastic.co/t/jira-action-sending-broken-links-on-detection-jobs/268809)
**Author:** [@Balor](https://discuss.elastic.co/u/Balor)\ **Replies:** 1\ **Last updated:** [April 1, 2021, 5:01pm UTC](https://discuss.elastic.co/t/jira-action-sending-broken-links-on-detection-jobs/268809 "2021-04-01T17:01:21Z")
Hello Elastic discuss, Am on: ECE 2.9.0 Elastic 7.12. I have been using the Detection API to add actions to certain Detection jobs. I am using a Jira connector. Am seeing this sort of behaviour in the action messag… --- ## [Elastic Agent Unenrollment](https://discuss.elastic.co/t/elastic-agent-unenrollment/266985)
**Author:** [@The1WhoPrtNocks](https://discuss.elastic.co/u/The1WhoPrtNocks)\ **Replies:** 2\ **Last updated:** [April 1, 2021, 8:29am UTC](https://discuss.elastic.co/t/elastic-agent-unenrollment/266985 "2021-04-01T08:29:09Z")
Hi, I was wondering if there were plans as part of an Agent un-enrolment to disable the Elastic Agent service on the host and delete the C:\\Program Files\\Elastic directory? As without doing that you can not re-enroll t… --- ## [Specific steps to build monitoring and siem with elk](https://discuss.elastic.co/t/specific-steps-to-build-monitoring-and-siem-with-elk/268605)
**Author:** [@Depressed](https://discuss.elastic.co/u/Depressed)\ **Replies:** 3\ **Last updated:** [March 29, 2021, 9:09pm UTC](https://discuss.elastic.co/t/specific-steps-to-build-monitoring-and-siem-with-elk/268605 "2021-03-29T21:09:09Z")
Hi I'm kinda new to whole siem and elk things and before i managed to setup monitoring with splunk cracked enterprise edition and there all was simple as forwarding data from netflow ,syslog ,snmp and defining new fi… --- ## [Measuring reaction to detection](https://discuss.elastic.co/t/measuring-reaction-to-detection/268362)
**Author:** [@Anna\_Foxx](https://discuss.elastic.co/u/Anna_Foxx)\ **Replies:** 4\ **Last updated:** [March 29, 2021, 8:49am UTC](https://discuss.elastic.co/t/measuring-reaction-to-detection/268362 "2021-03-29T08:49:48Z")
Hi! I want to know whether there is a functionality in Elastic Security to monitor reaction time to detection for example to count SLA. Is there smth called internal index from which I can get fields that will show me w… --- ## [See Who's changing signal detections](https://discuss.elastic.co/t/see-whos-changing-signal-detections/268545)
**Author:** [@Oliver2](https://discuss.elastic.co/u/Oliver2)\ **Replies:** 3\ **Last updated:** [March 28, 2021, 6:05pm UTC](https://discuss.elastic.co/t/see-whos-changing-signal-detections/268545 "2021-03-28T18:05:57Z")
Can you see which account have changed the signal.status field in elastic? if not can this be looked into I think it would be really useful to see which analyst is closing which detections --- ## [Error restoring state from URL - Kibana Dashboard](https://discuss.elastic.co/t/error-restoring-state-from-url-kibana-dashboard/268573)
**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Replies:** 3\ **Last updated:** [March 28, 2021, 4:16pm UTC](https://discuss.elastic.co/t/error-restoring-state-from-url-kibana-dashboard/268573 "2021-03-28T16:16:08Z")
Unable to completely restore the URL, be sure to use the share functionality. Error: Unable to completely restore the URL, be sure to use the share functionality. at throwUnableToRestoreUrlError (https://####.kb.eastus2… --- ## [7.11.0 Detections need permissions](https://discuss.elastic.co/t/7-11-0-detections-need-permissions/266610)
**Author:** [@mlove](https://discuss.elastic.co/u/mlove)\ **Replies:** 13\ **Last updated:** [March 26, 2021, 6:46pm UTC](https://discuss.elastic.co/t/7-11-0-detections-need-permissions/266610 "2021-03-26T18:46:59Z")
Hi All, I'm using docker-compose to deploy 5 elastic nodes and 1 kibana. I followed the guide here: Additionally, I have set the following fields: xpack.encryptedSavedObjects.encryptionKey: xpack.reporting.encrypt… --- ## [Detection threshold rule problem](https://discuss.elastic.co/t/detection-threshold-rule-problem/268079)
**Author:** [@Jorge7](https://discuss.elastic.co/u/Jorge7)\ **Replies:** 5\ **Last updated:** [March 25, 2021, 10:23am UTC](https://discuss.elastic.co/t/detection-threshold-rule-problem/268079 "2021-03-25T10:23:27Z")
Hi everyone, I'm try to create a personalize rule with the threshold parameter detection. I am using a handmade index with personal fields. This is the mapping: { "login-000001" : { "mappings" : { "properti… --- ## [Fleet Agent Goes from Online to Offline](https://discuss.elastic.co/t/fleet-agent-goes-from-online-to-offline/266745)
**Author:** [@pkward](https://discuss.elastic.co/u/pkward)\ **Replies:** 1\ **Last updated:** [March 24, 2021, 6:04pm UTC](https://discuss.elastic.co/t/fleet-agent-goes-from-online-to-offline/266745 "2021-03-24T18:04:11Z")
I enrolled my agent, but after a few minutes it goes offline .I found errors in my endpoint agent logs The error is "Error \[SSL certificate problem: self signed certificate in certificate chain\]". I was able to bypass th… --- ## [EQL detection rule run on indices created by Transforms](https://discuss.elastic.co/t/eql-detection-rule-run-on-indices-created-by-transforms/268022)
**Author:** [@hilo21](https://discuss.elastic.co/u/hilo21)\ **Replies:** 2\ **Last updated:** [March 24, 2021, 11:02am UTC](https://discuss.elastic.co/t/eql-detection-rule-run-on-indices-created-by-transforms/268022 "2021-03-24T11:02:15Z")
Hello all, I was trying to create an EQL rule that detects port scanning activity. In order to do that I created a tranform that runs an cardinality aggregation on destination port from my netflow logs : { "id": "por… --- ## [Unable to forward watcher alert to index with all details](https://discuss.elastic.co/t/unable-to-forward-watcher-alert-to-index-with-all-details/268048)
**Author:** [@aditi\_salunke](https://discuss.elastic.co/u/aditi_salunke)\ **Replies:** 2\ **Last updated:** [March 24, 2021, 5:54am UTC](https://discuss.elastic.co/t/unable-to-forward-watcher-alert-to-index-with-all-details/268048 "2021-03-24T05:54:51Z")
{ "trigger": { "schedule": { "interval": "15m" } }, "input": { "search": { "request": { "search\_type": "query\_then\_fetch", "indices": \[ "##selective index##" … --- ## [Unable to fetch custom indices data in ECS](https://discuss.elastic.co/t/unable-to-fetch-custom-indices-data-in-ecs/267742)
**Author:** [@aditi\_salunke](https://discuss.elastic.co/u/aditi_salunke)\ **Replies:** 2\ **Last updated:** [March 24, 2021, 5:54am UTC](https://discuss.elastic.co/t/unable-to-fetch-custom-indices-data-in-ecs/267742 "2021-03-24T05:54:21Z")
If i add my custom indices in data sources on elastic security then how should i map field in ecs --- ## [Issue with Signals in ELK7.8](https://discuss.elastic.co/t/issue-with-signals-in-elk7-8/266699)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 3\ **Last updated:** [March 23, 2021, 11:02pm UTC](https://discuss.elastic.co/t/issue-with-signals-in-elk7-8/266699 "2021-03-23T23:02:33Z")
Hi, I have 200 rule signals running. There are 80 Elastic default rules and 120 custom rules. Last response of most of the rules are showing succeeded but last run is 6 days ago and more. There is no error message. Pl… --- ## [How to define time range in custom query rule in elasticsiem?](https://discuss.elastic.co/t/how-to-define-time-range-in-custom-query-rule-in-elasticsiem/267521)
**Author:** [@siginigin](https://discuss.elastic.co/u/siginigin)\ **Replies:** 5\ **Last updated:** [March 23, 2021, 8:41pm UTC](https://discuss.elastic.co/t/how-to-define-time-range-in-custom-query-rule-in-elasticsiem/267521 "2021-03-23T20:41:37Z")
Hi, I'm trying to create rule which should fire on admin activity when time of event is from 22:00 till 5:00. I tried this query: user.group.name :\*admin\* and ((@timestamp \>= "00:00:00" and @timestamp \<= "05:00:00" ) … --- ## [Severity override range](https://discuss.elastic.co/t/severity-override-range/268064)
**Author:** [@buzzdeee](https://discuss.elastic.co/u/buzzdeee)\ **Replies:** 0\ **Last updated:** [March 23, 2021, 9:19am UTC](https://discuss.elastic.co/t/severity-override-range/268064 "2021-03-23T09:19:50Z")
Hi, I'm running ELK stack version 7.11.2. I want to ingest AWS GuardDuty alerts, these have severities defined: https://docs.aws.amazon.com/guardduty/latest/ug/guardduty\_findings.html basically values between 1.0 and… --- ## [Security Logs from S3 Bucket](https://discuss.elastic.co/t/security-logs-from-s3-bucket/267963)
**Author:** [@Gosborne](https://discuss.elastic.co/u/Gosborne)\ **Replies:** 1\ **Last updated:** [March 22, 2021, 11:26am UTC](https://discuss.elastic.co/t/security-logs-from-s3-bucket/267963 "2021-03-22T11:26:25Z")
Good Morning, We currently have a very strange situation in which we get a series of security logs placed into a single file in an S3 bucket every 8 hours (windows event logs, syslog, and a few others) which we need to … --- ## [Edit Telnet port Activity rule](https://discuss.elastic.co/t/edit-telnet-port-activity-rule/267061)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 2\ **Last updated:** [March 22, 2021, 10:04am UTC](https://discuss.elastic.co/t/edit-telnet-port-activity-rule/267061 "2021-03-22T10:04:47Z")
Hi, The Telnet Port Activity detection rule triggers whenever there is port scan / activity is tried Even if the port is closed How can I edit the below rule to trigger ONLY if port is open? event.category:(network or… --- ## [Elastic Agent to Logstash](https://discuss.elastic.co/t/elastic-agent-to-logstash/266341)
**Author:** [@The1WhoPrtNocks](https://discuss.elastic.co/u/The1WhoPrtNocks)\ **Replies:** 4\ **Last updated:** [March 19, 2021, 4:50pm UTC](https://discuss.elastic.co/t/elastic-agent-to-logstash/266341 "2021-03-19T16:50:36Z")
Hi, I was wondering if there are any plans to allow for shipping Agent collected Logs to Logstash, this is to allow for further enrichment. I have had a quick google but could not find anything on this subject. Thanks… --- ## [Create a Automation Between List API and Github Repo](https://discuss.elastic.co/t/create-a-automation-between-list-api-and-github-repo/267434)
**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Replies:** 6\ **Last updated:** [March 19, 2021, 4:10am UTC](https://discuss.elastic.co/t/create-a-automation-between-list-api-and-github-repo/267434 "2021-03-19T04:10:29Z")
I want to create a automation using the List API like the image below and a github repo so whenever I update the github repo that it will automatically update the corresponding lists in Elastic. How would I got about t… --- ## [Custom name for http certificate in elastic cluster](https://discuss.elastic.co/t/custom-name-for-http-certificate-in-elastic-cluster/267009)
**Author:** [@dzyubanv](https://discuss.elastic.co/u/dzyubanv)\ **Replies:** 9\ **Last updated:** [March 19, 2021, 12:31am UTC](https://discuss.elastic.co/t/custom-name-for-http-certificate-in-elastic-cluster/267009 "2021-03-19T00:31:19Z")
Hi elastic engineers, I have a few questions in regards to the certificate generation process \[1\] Is it allowed to use custom name for http certificate instead of default http.p12 ? The elasticsearch-certutil does all… --- ## [Reporting email action failure from watcher - ELK7.8](https://discuss.elastic.co/t/reporting-email-action-failure-from-watcher-elk7-8/267322)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 2\ **Last updated:** [March 18, 2021, 6:16pm UTC](https://discuss.elastic.co/t/reporting-email-action-failure-from-watcher-elk7-8/267322 "2021-03-18T18:16:36Z")
Hi Team, Please help me to resolve the email action failure error mentioned below from watcher. I am using ELK version 7.8. "id": "email\_action", "type": "email", "status": "failure", "error": { "root\_cause": \[ { … --- ## [Elastic Agent stops working](https://discuss.elastic.co/t/elastic-agent-stops-working/266219)
**Author:** [@Cosmin\_Ciobanu1](https://discuss.elastic.co/u/Cosmin_Ciobanu1)\ **Replies:** 7\ **Last updated:** [March 18, 2021, 3:52pm UTC](https://discuss.elastic.co/t/elastic-agent-stops-working/266219 "2021-03-18T15:52:18Z")
I've installed elastic agent and it connects to my Kibana, but after some seconds I get this error: "Application: metricbeat--7.11.1\[e9e46cd0-792e-11eb-8062-9be23ea21776\]: State changed to FAILED: 1 error: 1 error: Error… --- ## [Fortinet.tmp.\*](https://discuss.elastic.co/t/fortinet-tmp/267213)
**Author:** [@michaelv](https://discuss.elastic.co/u/michaelv)\ **Replies:** 8\ **Last updated:** [March 17, 2021, 4:28am UTC](https://discuss.elastic.co/t/fortinet-tmp/267213 "2021-03-17T04:28:17Z")
Hi, I'm trying out fortinet filebeat plugin. Running ELK with 7.10.1 and filebeat 7.10.1 However, I'm getting a strange input values into the documents (in the filebeat-\* index) This is my config - module: fortin… --- ## [Analyse events under detection is not working](https://discuss.elastic.co/t/analyse-events-under-detection-is-not-working/266444)
**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\ **Replies:** 3\ **Last updated:** [March 16, 2021, 5:53pm UTC](https://discuss.elastic.co/t/analyse-events-under-detection-is-not-working/266444 "2021-03-16T17:53:22Z")
Hello, Prior to updating to 7.11.1, analyse events as part of detection alerts was showing chain of events and allowing for quick analysis. However, post the upgrade; I see an "error loading data" whenever I click on an… --- ## [SIEM Network Map Errors](https://discuss.elastic.co/t/siem-network-map-errors/266386)
**Author:** [@Lin2020](https://discuss.elastic.co/u/Lin2020)\ **Replies:** 1\ **Last updated:** [March 16, 2021, 5:49pm UTC](https://discuss.elastic.co/t/siem-network-map-errors/266386 "2021-03-16T17:49:42Z")
The error on the map is "The Source Point and Destination Point no results found" and SIEM-Network-Flows: Autonomous system, Bytes in, Bytes out....no items displayed Discover error-firewall logs [Previous page](https://discuss.elastic.co/c/security/83.md?page=48) [Next page](https://discuss.elastic.co/c/security/83.md?page=50)