# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=5 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 6 --- ## [Exception for "Potential Antimalware Scan Interface Bypass via PowerShell"](https://discuss.elastic.co/t/exception-for-potential-antimalware-scan-interface-bypass-via-powershell/378627)
**Author:** [@GKre](https://discuss.elastic.co/u/GKre)\ **Replies:** 3\ **Last updated:** [June 15, 2025, 4:42am UTC](https://discuss.elastic.co/t/exception-for-potential-antimalware-scan-interface-bypass-via-powershell/378627 "2025-06-15T04:42:04Z")
Hello, there's a lot of false positives from "Potential Antimalware Scan Interface Bypass via PowerShell". Some of the rules i could find an exception as the script location was part of the message. In this case i could… --- ## [About xpack.fleet.registryUrl option](https://discuss.elastic.co/t/about-xpack-fleet-registryurl-option/378333)
**Author:** [@rezgui](https://discuss.elastic.co/u/rezgui)\ **Replies:** 1\ **Last updated:** [June 12, 2025, 7:19am UTC](https://discuss.elastic.co/t/about-xpack-fleet-registryurl-option/378333 "2025-06-12T07:19:06Z")
hello i will like to know with url can get take the option xpack.fleet.registryUrl for kibana 8.3.4 version and i have an access to internet best regards --- ## [\*\*Only some alerts are triggered during scheduled execution.\*\*](https://discuss.elastic.co/t/only-some-alerts-are-triggered-during-scheduled-execution/379037)
**Author:** [@Kick](https://discuss.elastic.co/u/Kick)\ **Replies:** 1\ **Last updated:** [June 10, 2025, 5:16am UTC](https://discuss.elastic.co/t/only-some-alerts-are-triggered-during-scheduled-execution/379037 "2025-06-10T05:16:44Z")
Below is the English translation: In Kibana, we trigger alerts for logs imported from external sources using the rule below. While manual execution detects all matching logs without any issue, scheduled execution fail… --- ## [API usage for Post Case in other tenants](https://discuss.elastic.co/t/api-usage-for-post-case-in-other-tenants/379035)
**Author:** [@kulisiber](https://discuss.elastic.co/u/kulisiber)\ **Replies:** 0\ **Last updated:** [June 10, 2025, 2:34am UTC](https://discuss.elastic.co/t/api-usage-for-post-case-in-other-tenants/379035 "2025-06-10T02:34:11Z")
Hi Elastic Friend, Do any of you know how to use the post to case to another tenant? I have a need to create an automation script based on the pattern from the draft, if it matches the desired pattern I want to create a… --- ## [Fleet-server mapping error in 9.0.2](https://discuss.elastic.co/t/fleet-server-mapping-error-in-9-0-2/378837)
**Author:** [@syk](https://discuss.elastic.co/u/syk)\ **Replies:** 2\ **Last updated:** [June 6, 2025, 9:07pm UTC](https://discuss.elastic.co/t/fleet-server-mapping-error-in-9-0-2/378837 "2025-06-06T21:07:24Z")
Self hosted ELK 9.0.2 records this mapping error from fleet-server running on an elastic-cluster-node once per minute: "error.message": "elastic fail 400: document\_parsing\_exception: \[1:207\] object mapping for \[local\_m… --- ## [Question related to ESA-2025-02 (security advisory)](https://discuss.elastic.co/t/question-related-to-esa-2025-02-security-advisory/377141)
**Author:** [@Stepf](https://discuss.elastic.co/u/Stepf)\ **Replies:** 1\ **Last updated:** [June 5, 2025, 4:31pm UTC](https://discuss.elastic.co/t/question-related-to-esa-2025-02-security-advisory/377141 "2025-06-05T16:31:30Z")
Hello, Kibana 8.16.4 and 8.17.2 Security Update (ESA-2025-02) is a security advisory against Prototype Pollution in Kibana, which can lead to code injection via unrestricted file upload combined with path traversal. I … --- ## [Configure the Custom AWS Logs integration to collect logs only from one folder in the AWS s3 bucket](https://discuss.elastic.co/t/configure-the-custom-aws-logs-integration-to-collect-logs-only-from-one-folder-in-the-aws-s3-bucket/378916)
**Author:** [@Cristina\_Marletta\_Li](https://discuss.elastic.co/u/Cristina_Marletta_Li)\ **Replies:** 0\ **Last updated:** [June 5, 2025, 12:55pm UTC](https://discuss.elastic.co/t/configure-the-custom-aws-logs-integration-to-collect-logs-only-from-one-folder-in-the-aws-s3-bucket/378916 "2025-06-05T12:55:16Z")
Hi all, We have an S3 bucket that contains two folders. Our goal is to collect only the files under the folder1, ignoring the folder2 folder entirely. How can we configure Custom AWS Logs to ingest only the contents of… --- ## [How to get the different counts mentioned for threat matches detected and fields enriched with threat intelligence under threat intelligence overview in Security Alerting](https://discuss.elastic.co/t/how-to-get-the-different-counts-mentioned-for-threat-matches-detected-and-fields-enriched-with-threat-intelligence-under-threat-intelligence-overview-in-security-alerting/378346)
**Author:** [@Sergie](https://discuss.elastic.co/u/Sergie)\ **Replies:** 1\ **Last updated:** [June 3, 2025, 8:46pm UTC](https://discuss.elastic.co/t/how-to-get-the-different-counts-mentioned-for-threat-matches-detected-and-fields-enriched-with-threat-intelligence-under-threat-intelligence-overview-in-security-alerting/378346 "2025-06-03T20:46:44Z")
Under threat intelligence overview tab, how can I calculate the different counts mentioned for threat matches detected and fields enriched with threat intelligence For my use case I wanted to understand is there an A… --- ## [How can I get the list of Cases from Kibana Security which are updated in the last day?](https://discuss.elastic.co/t/how-can-i-get-the-list-of-cases-from-kibana-security-which-are-updated-in-the-last-day/378639)
**Author:** [@Sergie](https://discuss.elastic.co/u/Sergie)\ **Replies:** 1\ **Last updated:** [June 3, 2025, 3:57pm UTC](https://discuss.elastic.co/t/how-can-i-get-the-list-of-cases-from-kibana-security-which-are-updated-in-the-last-day/378639 "2025-06-03T15:57:25Z")
Is there an API or a way where I can get the cases built in Kibana Security thing based on last\_updated value from a case. basically I want to get a list of cases that have been updated in last 24 hours I tried using t… --- ## [Integration FortiDLP to Elastic SIEM](https://discuss.elastic.co/t/integration-fortidlp-to-elastic-siem/378724)
**Author:** [@Charles\_Nkuna](https://discuss.elastic.co/u/Charles_Nkuna)\ **Replies:** 0\ **Last updated:** [May 30, 2025, 8:28am UTC](https://discuss.elastic.co/t/integration-fortidlp-to-elastic-siem/378724 "2025-05-30T08:28:01Z")
Hello, Just wanted to ask if its possible to intergrate FortiDLP with Elastic...if so based on the methode or mode below can we use : Event ingestion modes The Event Streaming Service supports two modes of event ing… --- ## [Start Elatsic Security and Observability](https://discuss.elastic.co/t/start-elatsic-security-and-observability/378565)
**Author:** [@felixwong](https://discuss.elastic.co/u/felixwong)\ **Replies:** 3\ **Last updated:** [May 28, 2025, 5:53pm UTC](https://discuss.elastic.co/t/start-elatsic-security-and-observability/378565 "2025-05-28T17:53:28Z")
I am working on building Elastic Security for my company. I want to monitor user login activity and receive alerts when suspicious login behavior occurs. Which Elastic product should I use for this purpose? From what I … --- ## [Temporarily disable Elastic Endpoint on a specific host](https://discuss.elastic.co/t/temporarily-disable-elastic-endpoint-on-a-specific-host/378634)
**Author:** [@ArgoAdvisory](https://discuss.elastic.co/u/ArgoAdvisory)\ **Replies:** 3\ **Last updated:** [May 28, 2025, 3:09pm UTC](https://discuss.elastic.co/t/temporarily-disable-elastic-endpoint-on-a-specific-host/378634 "2025-05-28T15:09:26Z")
Good morning everyone! I think Elastic Endpoint (or Elastic Defend) is a valid antivirus. I would like to understand one thing. How can I temporarily disable the antivirus on a specific host? I am the administrator, … --- ## [Detection Rules (SIEM) exceptions bug?](https://discuss.elastic.co/t/detection-rules-siem-exceptions-bug/378531)
**Author:** [@marrc.rousseau](https://discuss.elastic.co/u/marrc.rousseau)\ **Replies:** 2\ **Last updated:** [May 28, 2025, 6:18am UTC](https://discuss.elastic.co/t/detection-rules-siem-exceptions-bug/378531 "2025-05-28T06:18:22Z")
Hello, Everytime I try to create an exception for builtin security rule "Enumeration of Kernel Modules" I receive an error : type: Invalid literal value, expected "new\_terms", language: Invalid enum value. Expected 'ku… --- ## [Open Source Vulnerabilities](https://discuss.elastic.co/t/open-source-vulnerabilities/378456)
**Author:** [@rajesh\_raghav](https://discuss.elastic.co/u/rajesh_raghav)\ **Replies:** 9\ **Last updated:** [May 28, 2025, 4:22am UTC](https://discuss.elastic.co/t/open-source-vulnerabilities/378456 "2025-05-28T04:22:20Z")
We observed there are several components used in Elasticsearch package(8.17.1) which even when upgraded refer to old libraries with Open Vulnerabilities. In our orgnaization, these vulnerabilities are flagged on a regula… --- ## [How to get the List of highlighted fields attached per rule in Alerts flyout in Security Analytics](https://discuss.elastic.co/t/how-to-get-the-list-of-highlighted-fields-attached-per-rule-in-alerts-flyout-in-security-analytics/377423)
**Author:** [@Sergie](https://discuss.elastic.co/u/Sergie)\ **Replies:** 7\ **Last updated:** [May 27, 2025, 8:33pm UTC](https://discuss.elastic.co/t/how-to-get-the-list-of-highlighted-fields-attached-per-rule-in-alerts-flyout-in-security-analytics/377423 "2025-05-27T20:33:19Z")
For my use case I want to understand, is there an API associated, which gives the highlighted fields section in the alerts flyout in Security Plugin in Kibana. The highlighted fields which gets generated in the alert fl… --- ## [Session View missing in Alerts](https://discuss.elastic.co/t/session-view-missing-in-alerts/378161)
**Author:** [@gyterpena](https://discuss.elastic.co/u/gyterpena)\ **Replies:** 1\ **Last updated:** [May 27, 2025, 8:08pm UTC](https://discuss.elastic.co/t/session-view-missing-in-alerts/378161 "2025-05-27T20:08:51Z")
Hello We have enabled "Collect session data" and "Capture terminal output" under defend policy for linux, but we can not see "Open Session View" button under alerts(or other relevant places). Do we have to enable it so… --- ## [Question about malware sample distribute / sharing](https://discuss.elastic.co/t/question-about-malware-sample-distribute-sharing/378465)
**Author:** [@Mrjh0n1337](https://discuss.elastic.co/u/Mrjh0n1337)\ **Replies:** 1\ **Last updated:** [May 27, 2025, 6:03pm UTC](https://discuss.elastic.co/t/question-about-malware-sample-distribute-sharing/378465 "2025-05-27T18:03:28Z")
I'm a pentester exploring malware dev and want to setup Elastic EDR locally for testing, for the life of me i can't not find anything about detected sample getting share further analysis in Elastic documents. A friend f… --- ## [Intégration server fleet](https://discuss.elastic.co/t/integration-server-fleet/378296)
**Author:** [@rezgui](https://discuss.elastic.co/u/rezgui)\ **Replies:** 1\ **Last updated:** [May 27, 2025, 3:36pm UTC](https://discuss.elastic.co/t/integration-server-fleet/378296 "2025-05-27T15:36:44Z")
hello i have a problem with rgistery there is the error message Kibana cannot reach the Elastic Package Registry, which provides Elastic Agent integrations with curl it work well but throw kibana i had this error r… --- ## [Syscalls tapped by elastic defend](https://discuss.elastic.co/t/syscalls-tapped-by-elastic-defend/378135)
**Author:** [@Snow](https://discuss.elastic.co/u/Snow)\ **Replies:** 4\ **Last updated:** [May 27, 2025, 7:58am UTC](https://discuss.elastic.co/t/syscalls-tapped-by-elastic-defend/378135 "2025-05-27T07:58:01Z")
i could see the below list of events tapped by elastic defend, apart from this, what are the list of syscalls tapped by elastic defend? end (process event) fork (process event) exec (process event) uid\_change (proc… --- ## [Unable to create actions client because the Encrypted Saved Objects plugin is missing encryption key](https://discuss.elastic.co/t/unable-to-create-actions-client-because-the-encrypted-saved-objects-plugin-is-missing-encryption-key/378530)
**Author:** [@felixwong](https://discuss.elastic.co/u/felixwong)\ **Replies:** 4\ **Last updated:** [May 26, 2025, 10:30am UTC](https://discuss.elastic.co/t/unable-to-create-actions-client-because-the-encrypted-saved-objects-plugin-is-missing-encryption-key/378530 "2025-05-26T10:30:58Z")
This is my first time to launch elastic security . There is a pop up showed Unable to create actions client because the Encrypted Saved Objects plugin is missing encryption key. Please set xpack.encryptedSavedObjects.e… --- ## [How to detect abnormal User behaviour (sequence of actions)](https://discuss.elastic.co/t/how-to-detect-abnormal-user-behaviour-sequence-of-actions/377964)
**Author:** [@GlebCA](https://discuss.elastic.co/u/GlebCA)\ **Replies:** 3\ **Last updated:** [May 24, 2025, 4:14pm UTC](https://discuss.elastic.co/t/how-to-detect-abnormal-user-behaviour-sequence-of-actions/377964 "2025-05-24T16:14:42Z")
Hi, Need help - how to detect abnormal User behaviour (sequence of actions) using Elastic ML (or other tools)? For example - user can perform following actions: Login Read Patients List Read Patient Info Read Clinica… --- ## [Cef log with custom udp integration](https://discuss.elastic.co/t/cef-log-with-custom-udp-integration/378421)
**Author:** [@Cristina\_Marletta\_Li](https://discuss.elastic.co/u/Cristina_Marletta_Li)\ **Replies:** 4\ **Last updated:** [May 22, 2025, 2:19pm UTC](https://discuss.elastic.co/t/cef-log-with-custom-udp-integration/378421 "2025-05-22T14:19:19Z")
Hi all, I am using Custom UDP integration to do CEF log ingestion. I cannot use CEF integration due to limitations of that integration. The decode\_cef processor is not available in the pipelines. What is the best way to… --- ## ['add agent' issue](https://discuss.elastic.co/t/add-agent-issue/378397)
**Author:** [@ASahinkayasi](https://discuss.elastic.co/u/ASahinkayasi)\ **Replies:** 0\ **Last updated:** [May 21, 2025, 10:02pm UTC](https://discuss.elastic.co/t/add-agent-issue/378397 "2025-05-21T22:02:42Z")
Hi, I'm following the Elastic Security for SIEM (On-Demand) course. I'm still at the beginning of the course and I'm stuck on 'add agent' in Fleet. The system gives the error in the image. Does anyone have any idea how I… --- ## [Error while enabling security rules](https://discuss.elastic.co/t/error-while-enabling-security-rules/378261)
**Author:** [@Devansh\_Shah](https://discuss.elastic.co/u/Devansh_Shah)\ **Replies:** 1\ **Last updated:** [May 20, 2025, 9:36pm UTC](https://discuss.elastic.co/t/error-while-enabling-security-rules/378261 "2025-05-20T21:36:56Z")
I am facing an issue while enabling rules on elastic security. When i try to enable the same, it throws the following error: { "name": "Error", "body": { "message": "Cannot read properties of undefined (readi… --- ## [Does Elastic Defend receive detection updates?](https://discuss.elastic.co/t/does-elastic-defend-receive-detection-updates/378305)
**Author:** [@MatthewGeneNavarro](https://discuss.elastic.co/u/MatthewGeneNavarro)\ **Replies:** 2\ **Last updated:** [May 20, 2025, 8:14pm UTC](https://discuss.elastic.co/t/does-elastic-defend-receive-detection-updates/378305 "2025-05-20T20:14:25Z")
Hi, I know that Elastic is a relatively new player to the EDR sector and I wanted to know, does Elastic have a team that is pushing updates to the Elastics EDR? For example, a company like Palo Alto and their EDR Corte… --- ## [Enriching Web Filter Logs with Username from Traffic Logs Using Session ID in Fortinet Logs](https://discuss.elastic.co/t/enriching-web-filter-logs-with-username-from-traffic-logs-using-session-id-in-fortinet-logs/377978)
**Author:** [@Johan\_Alda](https://discuss.elastic.co/u/Johan_Alda)\ **Replies:** 0\ **Last updated:** [May 9, 2025, 6:07am UTC](https://discuss.elastic.co/t/enriching-web-filter-logs-with-username-from-traffic-logs-using-session-id-in-fortinet-logs/377978 "2025-05-09T06:07:29Z")
Title: How to Enrich Fortinet UTM Web Filter Logs with Username from Traffic Logs Using Session ID? Body: Hi everyone, I'm working on a detection use case using Fortinet logs ingested into Elasticsearch. Objective: I … --- ## [Anybody successfully created a detection rule for Red Hat security updates](https://discuss.elastic.co/t/anybody-successfully-created-a-detection-rule-for-red-hat-security-updates/377446)
**Author:** [@taprove](https://discuss.elastic.co/u/taprove)\ **Replies:** 1\ **Last updated:** [May 9, 2025, 10:58am UTC](https://discuss.elastic.co/t/anybody-successfully-created-a-detection-rule-for-red-hat-security-updates/377446 "2025-05-09T10:58:02Z")
I read that is is possible to create a detection rule to alert if there are security updates required on a Red Hat or CentOS box (we use RHEL for production, CentOS for testing). I came across the following "query" but … --- ## [Import ingest pipeline](https://discuss.elastic.co/t/import-ingest-pipeline/377843)
**Author:** [@Cristina\_Marletta\_Li](https://discuss.elastic.co/u/Cristina_Marletta_Li)\ **Replies:** 1\ **Last updated:** [May 6, 2025, 12:12pm UTC](https://discuss.elastic.co/t/import-ingest-pipeline/377843 "2025-05-06T12:12:03Z")
Hi all, how can i import a complex custom ingestion pipeline from one elastic to another? I tried with the 'Import processors' button but after loading the json containing the processors array and pressing the 'Load and… --- ## [Error in detection rule: Remote Computer Account DnsHostName Update](https://discuss.elastic.co/t/error-in-detection-rule-remote-computer-account-dnshostname-update/377772)
**Author:** [@GKre](https://discuss.elastic.co/u/GKre)\ **Replies:** 8\ **Last updated:** [May 3, 2025, 7:12pm UTC](https://discuss.elastic.co/t/error-in-detection-rule-remote-computer-account-dnshostname-update/377772 "2025-05-03T19:12:11Z")
I have an issue with a detection rule. Seems like there's a type mismatch in tables. Is this something i could fix myself or should this be handled by dev? { "@timestamp": \[ "2025-05-03T08:36:23.495Z" \], "ecs.… --- ## [Wrong ML Job query packetbeat\_rare\_user\_agent or missing event.dataset in network traffic data?](https://discuss.elastic.co/t/wrong-ml-job-query-packetbeat-rare-user-agent-or-missing-event-dataset-in-network-traffic-data/377283)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 2\ **Last updated:** [April 29, 2025, 6:56pm UTC](https://discuss.elastic.co/t/wrong-ml-job-query-packetbeat-rare-user-agent-or-missing-event-dataset-in-network-traffic-data/377283 "2025-04-29T18:56:15Z")
Hello, The query of the managed machine learning job packetbeat\_rare\_user\_agent doesn't match with any documents. It seems like event.dataset is not in the logs-network\_traffic.http-\* datastream? {"bool":{"filter":\[{"t… [Previous page](https://discuss.elastic.co/c/security/83.md?page=4) [Next page](https://discuss.elastic.co/c/security/83.md?page=6)