# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=50 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 51 --- ## [How to stop Elastic Endpoint](https://discuss.elastic.co/t/how-to-stop-elastic-endpoint/267283)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 5\ **Last updated:** [March 15, 2021, 11:40pm UTC](https://discuss.elastic.co/t/how-to-stop-elastic-endpoint/267283 "2021-03-15T23:40:05Z")
Hello, I am testing elastic Endpoint, I have installed it in a windows server machine, and when I try to install a malware in my machine it blocks it as expected so it works perfectly, The only problem is that I am not … --- ## [How to upload ".toml" rules from github to Kibana](https://discuss.elastic.co/t/how-to-upload-toml-rules-from-github-to-kibana/267274)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 1\ **Last updated:** [March 15, 2021, 7:24pm UTC](https://discuss.elastic.co/t/how-to-upload-toml-rules-from-github-to-kibana/267274 "2021-03-15T19:24:39Z")
Hello, I would like to upload this rule: https://github.com/elastic/detection-rules/blob/a0e86e20d6ad039dfe4446b28f3c29642b50385c/rules/windows/credential\_access\_cmdline\_dump\_tool.toml to my Cluster The problem is in K… --- ## [Elastic-Agent not providing data-stream](https://discuss.elastic.co/t/elastic-agent-not-providing-data-stream/259433)
**Author:** [@cwobuzz](https://discuss.elastic.co/u/cwobuzz)\ **Replies:** 3\ **Last updated:** [March 15, 2021, 10:33am UTC](https://discuss.elastic.co/t/elastic-agent-not-providing-data-stream/259433 "2021-03-15T10:33:25Z")
I have a docker with xpac enabled. I documented what I did here: https://github.com/cwobuzz/Setting-up-Docker-Elastic-Kibana-Running-Sysmon-And-Agent/blob/master/.README.md I have agent successfully installed. However … --- ## [Elastic Agent rolled with Sysmon](https://discuss.elastic.co/t/elastic-agent-rolled-with-sysmon/266987)
**Author:** [@The1WhoPrtNocks](https://discuss.elastic.co/u/The1WhoPrtNocks)\ **Replies:** 0\ **Last updated:** [March 11, 2021, 5:49pm UTC](https://discuss.elastic.co/t/elastic-agent-rolled-with-sysmon/266987 "2021-03-11T17:49:08Z")
Hi, I was always under the impression that you needed to deploy Sysmon along side the Agent however I have just accidentaly educated myself during a lab re-build and can see that Sysmon is rolled with the Agent. Howeve… --- ## [Match rule not working](https://discuss.elastic.co/t/match-rule-not-working/266666)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 6\ **Last updated:** [March 11, 2021, 8:51am UTC](https://discuss.elastic.co/t/match-rule-not-working/266666 "2021-03-11T08:51:25Z")
Hello, I am trying to add a threat intelligence in my SIEM, I downloaded the database of malware hashes, and I am using auditbeat file integrity to detect malware, and then I created a rmatch rule like that: and the… --- ## [EQL - Alert on different values for the same field in a sequence](https://discuss.elastic.co/t/eql-alert-on-different-values-for-the-same-field-in-a-sequence/255344)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 6\ **Last updated:** [March 10, 2021, 6:33pm UTC](https://discuss.elastic.co/t/eql-alert-on-different-values-for-the-same-field-in-a-sequence/255344 "2021-03-10T18:33:41Z")
Hi, I am trying to build a sequence, as an example to look for multiple different user.names from the same host over a period of time. How would i go about this condition 2 user.name != condition 1 user.name. There a … --- ## [Index/API end point to edit detection rules?](https://discuss.elastic.co/t/index-api-end-point-to-edit-detection-rules/266401)
**Author:** [@aidanoc15](https://discuss.elastic.co/u/aidanoc15)\ **Replies:** 1\ **Last updated:** [March 8, 2021, 12:12pm UTC](https://discuss.elastic.co/t/index-api-end-point-to-edit-detection-rules/266401 "2021-03-08T12:12:33Z")
Hi, we are currently in the process of migrating off of our old SIEM and into elastic siem. We have created a bunch of detection rules already in Elastic but we still need to move over all the exceptions for those rules … --- ## [Detection Rules Triggered although ports are closed!](https://discuss.elastic.co/t/detection-rules-triggered-although-ports-are-closed/266533)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 0\ **Last updated:** [March 8, 2021, 10:28am UTC](https://discuss.elastic.co/t/detection-rules-triggered-although-ports-are-closed/266533 "2021-03-08T10:28:31Z")
Hi, In SEIM, I can see some detection rules are triggered like although the related ports are already closed: signal.rule.name: "Telnet Port Activity" (which works on port 23) and signal.rule.name: "SMTP on Port 26/T… --- ## [Detection Failiure in ELK7.8 SIEM](https://discuss.elastic.co/t/detection-failiure-in-elk7-8-siem/266217)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 1\ **Last updated:** [March 5, 2021, 10:18pm UTC](https://discuss.elastic.co/t/detection-failiure-in-elk7-8-siem/266217 "2021-03-05T22:18:07Z")
Hello, It is noticed that detection rule is getting failed by showing the bellow error message. "Consider increasing your look back time or adding more Kibana instances." I have tried increasing the look back time fro… --- ## [Indicator match rule not matched and Mapped with filebeat-\* (MISP Module)](https://discuss.elastic.co/t/indicator-match-rule-not-matched-and-mapped-with-filebeat-misp-module/266315)
**Author:** [@raviraja](https://discuss.elastic.co/u/raviraja)\ **Replies:** 1\ **Last updated:** [March 5, 2021, 10:01pm UTC](https://discuss.elastic.co/t/indicator-match-rule-not-matched-and-mapped-with-filebeat-misp-module/266315 "2021-03-05T22:01:05Z")
Hi guys, We are using ELK 7.11.1 version. We have ingested threat intelligence feeds from MISP server and stored in Elasticsearch through Filebeat.(Using Module MISP) and we want to map and match with Zscalerlog. Base… --- ## [Filebeat module's fields in SIEM columns](https://discuss.elastic.co/t/filebeat-modules-fields-in-siem-columns/266090)
**Author:** [@radovan](https://discuss.elastic.co/u/radovan)\ **Replies:** 1\ **Last updated:** [March 5, 2021, 7:42pm UTC](https://discuss.elastic.co/t/filebeat-modules-fields-in-siem-columns/266090 "2021-03-05T19:42:34Z")
Hi, after upgrading our cluster from 7.10.2 to 7.11.1 we can no more see values of filebeat module's fields in columns, for example suricata's fields (screenshot below), although they are included in the signal's fi… --- ## [How to combine alerts in one?](https://discuss.elastic.co/t/how-to-combine-alerts-in-one/266046)
**Author:** [@VellayLoket](https://discuss.elastic.co/u/VellayLoket)\ **Replies:** 13\ **Last updated:** [March 4, 2021, 11:09pm UTC](https://discuss.elastic.co/t/how-to-combine-alerts-in-one/266046 "2021-03-04T23:09:57Z")
For example, i have infected PC in my network, and it sends many requests to C2 malware domain. So, i setup detection rule for this C2C domain and now i have got 100500 alerts from only 1 IP of infected PC. How to combin… --- ## [Threshold Detection Ignoring Group By Field](https://discuss.elastic.co/t/threshold-detection-ignoring-group-by-field/264873)
**Author:** [@PhilA](https://discuss.elastic.co/u/PhilA)\ **Replies:** 6\ **Last updated:** [March 4, 2021, 3:02pm UTC](https://discuss.elastic.co/t/threshold-detection-ignoring-group-by-field/264873 "2021-03-04T15:02:10Z")
Hi I have upgraded to 7.11.0 and now 7.11.1 and I think there is an issue with Threshold detections. I have a simple detection based on my FW logs. It looks for flow\_denied or flow\_dropped messages and raises a detect… --- ## [Elastic Security for Android and iOS](https://discuss.elastic.co/t/elastic-security-for-android-and-ios/266232)
**Author:** [@kal1s](https://discuss.elastic.co/u/kal1s)\ **Replies:** 0\ **Last updated:** [March 4, 2021, 12:23pm UTC](https://discuss.elastic.co/t/elastic-security-for-android-and-ios/266232 "2021-03-04T12:23:37Z")
Hi Guys, We are designing a security solution for Desktop and Mobile and we considering Elastic Security for Desktop, and Checkpoint Harmony Mobile for Mobile. We're thinking, In the future will be possible to protect … --- ## [Detection Rules Triggered although ports are closed!](https://discuss.elastic.co/t/detection-rules-triggered-although-ports-are-closed/266207)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 0\ **Last updated:** [March 4, 2021, 10:05am UTC](https://discuss.elastic.co/t/detection-rules-triggered-although-ports-are-closed/266207 "2021-03-04T10:05:44Z")
Hi, In SEIM, I can see some detection rules are triggered like although the related ports are already closed: signal.rule.name: "Telnet Port Activity" (which works on port 23) and signal.rule.name: "SMTP on Port 26/… --- ## [Indicator Match Detection Rule Not Matched and Mapped to Intel Feeds](https://discuss.elastic.co/t/indicator-match-detection-rule-not-matched-and-mapped-to-intel-feeds/262446)
**Author:** [@ikbal](https://discuss.elastic.co/u/ikbal)\ **Replies:** 16\ **Last updated:** [March 4, 2021, 3:06am UTC](https://discuss.elastic.co/t/indicator-match-detection-rule-not-matched-and-mapped-to-intel-feeds/262446 "2021-03-04T03:06:22Z")
Hi guys, We are using ES 7.10.1 altogether with Logstash and Kibana. We have ingested TI feeds from MISP and index named as filebeat and we wanted to map and match it to Zscaler logs. We have tested tens of times just… --- ## [Fleet 0.0.0.0 address after Elastic Agent install](https://discuss.elastic.co/t/fleet-0-0-0-0-address-after-elastic-agent-install/265698)
**Author:** [@Cosmin\_Ciobanu1](https://discuss.elastic.co/u/Cosmin_Ciobanu1)\ **Replies:** 4\ **Last updated:** [March 3, 2021, 7:46pm UTC](https://discuss.elastic.co/t/fleet-0-0-0-0-address-after-elastic-agent-install/265698 "2021-03-03T19:46:22Z")
Hi! I've installed Elastci Agent with 10.10.10.19 address for both Kibana and Elasticsearch. However, after is starts I get this error "fail to checkin to fleet: Post "https://0.0.0.0:5601/api/fleet/agents/ID/checkin?"… --- ## [Exclusions for elastic EQL rules](https://discuss.elastic.co/t/exclusions-for-elastic-eql-rules/266144)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 0\ **Last updated:** [March 3, 2021, 5:39pm UTC](https://discuss.elastic.co/t/exclusions-for-elastic-eql-rules/266144 "2021-03-03T17:39:46Z")
Hi, We are trying to create exclusions for one of the new EQL rules - remote execution via file shares Within the detection there is no relevent info to base an exclusion, from the timeline we see the events and fields… --- ## [Elastic-Agent - filebeat and metricbeat - Error Log help](https://discuss.elastic.co/t/elastic-agent-filebeat-and-metricbeat-error-log-help/264054)
**Author:** [@cwobuzz](https://discuss.elastic.co/u/cwobuzz)\ **Replies:** 3\ **Last updated:** [March 3, 2021, 4:05pm UTC](https://discuss.elastic.co/t/elastic-agent-filebeat-and-metricbeat-error-log-help/264054 "2021-03-03T16:05:05Z")
I have ElasticSearch and Kibana running as dockers I documented it here: https://github.com/cwobuzz/Setting-up-Docker-Elastic-Kibana-Running-Sysmon-And-Agent/blob/master/.README.md My Elastic-Agent is pushing Endpoint s… --- ## [Does elastic Security agent replace the use of Auditbeat, packetbeat, and filebeat agents?](https://discuss.elastic.co/t/does-elastic-security-agent-replace-the-use-of-auditbeat-packetbeat-and-filebeat-agents/266021)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 2\ **Last updated:** [March 3, 2021, 3:43pm UTC](https://discuss.elastic.co/t/does-elastic-security-agent-replace-the-use-of-auditbeat-packetbeat-and-filebeat-agents/266021 "2021-03-03T15:43:00Z")
I was watching a webinar of SIEM with version 7.2 of elastic, and the speaker use multiples agents (Auditbeat, packetbeat, and filebeat agents) to feed SIEM, and now with elastic 7.11 there is a new agent, Endpoint, I wa… --- ## [Can you confirm this is false positive?](https://discuss.elastic.co/t/can-you-confirm-this-is-false-positive/266119)
**Author:** [@ThiruKumaran](https://discuss.elastic.co/u/ThiruKumaran)\ **Replies:** 3\ **Last updated:** [March 3, 2021, 3:09pm UTC](https://discuss.elastic.co/t/can-you-confirm-this-is-false-positive/266119 "2021-03-03T15:09:05Z")
Hi, Could you please check this file, as I think it is a false detection. his file has been falsely detected as malware link for the issue : https://www.virustotal.com/gui/file/4f8248e9f80ce5c367f75956a2f6b77262e72964… --- ## [X509 Certificate Error for Fleet Enrollment](https://discuss.elastic.co/t/x509-certificate-error-for-fleet-enrollment/264461)
**Author:** [@secopsgeek](https://discuss.elastic.co/u/secopsgeek)\ **Replies:** 4\ **Last updated:** [February 27, 2021, 6:59pm UTC](https://discuss.elastic.co/t/x509-certificate-error-for-fleet-enrollment/264461 "2021-02-27T18:59:26Z")
Hello friends, I am needing some help with setting up the fleet enrollment for my clients on windows systems. Am having an issue with this EDR portion of the SIEM build. Any help would be nice, I have the cert, but not … --- ## [Elastic Agent](https://discuss.elastic.co/t/elastic-agent/265670)
**Author:** [@Cosmin\_Ciobanu1](https://discuss.elastic.co/u/Cosmin_Ciobanu1)\ **Replies:** 1\ **Last updated:** [February 27, 2021, 3:27pm UTC](https://discuss.elastic.co/t/elastic-agent/265670 "2021-02-27T15:27:08Z")
Hi! I try to install Elastic Agent on my Windows and I have Elastic Stack on Ubuntu, but I have a big issue. "Certificate is valid for 10.10.10.19, not 10.10.10.19" is my error. It seem pretty sus. Any idea? Thank … --- ## [Detection not finding anything but same query finds them](https://discuss.elastic.co/t/detection-not-finding-anything-but-same-query-finds-them/265535)
**Author:** [@plaroche0](https://discuss.elastic.co/u/plaroche0)\ **Replies:** 5\ **Last updated:** [February 27, 2021, 1:57pm UTC](https://discuss.elastic.co/t/detection-not-finding-anything-but-same-query-finds-them/265535 "2021-02-27T13:57:39Z")
I made a detection from a saved query that shows what I want to detect but the detection is not detecting anything. Detection does not show any failures. Any suggestions? --- ## [Custom detection rules failing in bulk](https://discuss.elastic.co/t/custom-detection-rules-failing-in-bulk/265376)
**Author:** [@jhanvi](https://discuss.elastic.co/u/jhanvi)\ **Replies:** 2\ **Last updated:** [February 26, 2021, 6:51am UTC](https://discuss.elastic.co/t/custom-detection-rules-failing-in-bulk/265376 "2021-02-26T06:51:24Z")
Hi team, In the detection tab, I am observing that the rules are failing and throwing an error as below. Can you explain what exactly is causing the same? --- ## [All Rules are showing Failed](https://discuss.elastic.co/t/all-rules-are-showing-failed/264318)
**Author:** [@emmett.carey](https://discuss.elastic.co/u/emmett.carey)\ **Replies:** 28\ **Last updated:** [February 25, 2021, 5:16pm UTC](https://discuss.elastic.co/t/all-rules-are-showing-failed/264318 "2021-02-25T17:16:15Z")
Hi, I've recently set up Elastic Search and Kibana 7.11 and enrolled a VM via Fleet and Agent. In the process I set up a Policy and Assigned some detection rules as well as added the Security Endpoint Integration as we… --- ## [EQL signal query return with error](https://discuss.elastic.co/t/eql-signal-query-return-with-error/265465)
**Author:** [@qiratnahraf](https://discuss.elastic.co/u/qiratnahraf)\ **Replies:** 1\ **Last updated:** [February 25, 2021, 3:33pm UTC](https://discuss.elastic.co/t/eql-signal-query-return-with-error/265465 "2021-02-25T15:33:18Z")
Hi, We are on 7.10 and trying to use EQL signal but hit with error, although when we execute the same EQL query from console it successfully return results. please note in detection module we hit with error whenever we t… --- ## [Elastic-Agent vs Metricbeat standalone](https://discuss.elastic.co/t/elastic-agent-vs-metricbeat-standalone/252270)
**Author:** [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Replies:** 4\ **Last updated:** [February 25, 2021, 1:48pm UTC](https://discuss.elastic.co/t/elastic-agent-vs-metricbeat-standalone/252270 "2021-02-25T13:48:21Z")
Hi, Note: Running in Windows Server 2012 I have a couple of questions about the Metricbeat service running under Elastic-Agent: Can modules (for example MSSQL) be activated like the standalone version of Metricbeat? H… --- ## [Default email recipient address in email action in ELK7.8 Signals or 7.11 detections](https://discuss.elastic.co/t/default-email-recipient-address-in-email-action-in-elk7-8-signals-or-7-11-detections/265304)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 1\ **Last updated:** [February 24, 2021, 8:23pm UTC](https://discuss.elastic.co/t/default-email-recipient-address-in-email-action-in-elk7-8-signals-or-7-11-detections/265304 "2021-02-24T20:23:16Z")
Hello, Please let me know if there any option to configure recipient email address in a common file instead of configuring in each detection rules. This is really difficult task to manually configure email address in e… --- ## [Elastic agent showing unhealthy with windows system](https://discuss.elastic.co/t/elastic-agent-showing-unhealthy-with-windows-system/265341)
**Author:** [@jaykansagara](https://discuss.elastic.co/u/jaykansagara)\ **Replies:** 1\ **Last updated:** [February 24, 2021, 5:29pm UTC](https://discuss.elastic.co/t/elastic-agent-showing-unhealthy-with-windows-system/265341 "2021-02-24T17:29:14Z")
hi, I have install Elastic Agent 7.11.1 on windows server 2012 and enroll it with Fleet. Agent policy has 2 different integration as bellow: System Endpoint security Elastic agent write the logs in windows server as… [Previous page](https://discuss.elastic.co/c/security/83.md?page=49) [Next page](https://discuss.elastic.co/c/security/83.md?page=51)