# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=51 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 52 --- ## [Elastic security fields data not showing in Timeline](https://discuss.elastic.co/t/elastic-security-fields-data-not-showing-in-timeline/264235)
**Author:** [@ajesh](https://discuss.elastic.co/u/ajesh)\ **Replies:** 2\ **Last updated:** [February 24, 2021, 1:40pm UTC](https://discuss.elastic.co/t/elastic-security-fields-data-not-showing-in-timeline/264235 "2021-02-24T13:40:55Z")
Hi Team, We are not able to see proper data in timeline of elastic security module. issue 1: Summary not showing the correct data of detection rule Issue 2: Some field values are not showing in the timeline window… --- ## [Kibana Cases Analytics](https://discuss.elastic.co/t/kibana-cases-analytics/265116)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 5\ **Last updated:** [February 23, 2021, 6:55am UTC](https://discuss.elastic.co/t/kibana-cases-analytics/265116 "2021-02-23T06:55:39Z")
Hello, I need to do some basic analytics on the Kibana cases we created until now. Where are these cases indexed? For example I added some tags and I want to visualise the amount of cases out of all cases that have cert… --- ## [Elastic Endpoint Security on 150 Windows PCs](https://discuss.elastic.co/t/elastic-endpoint-security-on-150-windows-pcs/265008)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 6\ **Last updated:** [February 23, 2021, 12:16am UTC](https://discuss.elastic.co/t/elastic-endpoint-security-on-150-windows-pcs/265008 "2021-02-23T00:16:05Z")
I want to deploy Endpoint Security on 150 Windows PCs, how big should my Elastic Cloud container be to support all the data coming in? --- ## [Will Endpoint Security work offline?](https://discuss.elastic.co/t/will-endpoint-security-work-offline/265119)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 8:58pm UTC](https://discuss.elastic.co/t/will-endpoint-security-work-offline/265119 "2021-02-22T20:58:07Z")
Hello, if I deploy Endpoint Security to hundreds of computers, and suddenly they cannot contact Elastic Cloud for a few hours, will they continue to run, protect, and download the virus database and all? --- ## [Alert Variables in email action - EQL](https://discuss.elastic.co/t/alert-variables-in-email-action-eql/264695)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 3\ **Last updated:** [February 22, 2021, 5:32pm UTC](https://discuss.elastic.co/t/alert-variables-in-email-action-eql/264695 "2021-02-22T17:32:42Z")
Hello, Can someone please help to add additional field to the alert variable? I have mentioned the Detection EQL rule logic below. sequence with maxspan=5m \[authentication where event.type == "authentication\_failure"\]… --- ## [Endpoint Security Detection Rule Failed](https://discuss.elastic.co/t/endpoint-security-detection-rule-failed/265011)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 4:00pm UTC](https://discuss.elastic.co/t/endpoint-security-detection-rule-failed/265011 "2021-02-22T16:00:21Z")
Elastic Cloud, 7.11, added a brand new Agent on Windows 10: Why does it fail? --- ## [Elastic Endpoint shipping application and service logs](https://discuss.elastic.co/t/elastic-endpoint-shipping-application-and-service-logs/264693)
**Author:** [@The1WhoPrtNocks](https://discuss.elastic.co/u/The1WhoPrtNocks)\ **Replies:** 5\ **Last updated:** [February 19, 2021, 3:32pm UTC](https://discuss.elastic.co/t/elastic-endpoint-shipping-application-and-service-logs/264693 "2021-02-19T15:32:40Z")
Hi All, Currently I can not see a way to configure the endpoint agent to collect logs from sub categories of "Applications and Services". Is this something I am missing or a feature that will come in the future ? Thank… --- ## [D365 cloud based solution](https://discuss.elastic.co/t/d365-cloud-based-solution/264664)
**Author:** [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\ **Replies:** 1\ **Last updated:** [February 19, 2021, 12:02pm UTC](https://discuss.elastic.co/t/d365-cloud-based-solution/264664 "2021-02-19T12:02:43Z")
Hi There, Is it possible to extract the Dynamics 365 logs via filebeat? like Office 365 Hello, we're looking to better secure our Dynamics 365 instance, and we're wondering what were good options for logging admin e… --- ## [SIEM Detection alerts - Additional field adding in notification placeholders](https://discuss.elastic.co/t/siem-detection-alerts-additional-field-adding-in-notification-placeholders/264247)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 3\ **Last updated:** [February 18, 2021, 10:48pm UTC](https://discuss.elastic.co/t/siem-detection-alerts-additional-field-adding-in-notification-placeholders/264247 "2021-02-18T22:48:15Z")
Hi, How can i add additional fields in alert email action body in detection rules. I am using ELK 7.10. For eg: Need to include user.name and source.ip field in the rule alert in the body of alert email action. Rule L… --- ## [There seems to be a bug in 7.10.2's builtin ml job windows\_rare\_user\_type10\_remote\_login](https://discuss.elastic.co/t/there-seems-to-be-a-bug-in-7-10-2s-builtin-ml-job-windows-rare-user-type10-remote-login/264612)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [February 18, 2021, 7:05pm UTC](https://discuss.elastic.co/t/there-seems-to-be-a-bug-in-7-10-2s-builtin-ml-job-windows-rare-user-type10-remote-login/264612 "2021-02-18T19:05:20Z")
Hello, I noticed the windows\_rare\_user\_type10\_remote\_login ml job didn't produce a lot of data anymore.. To be sure there was nothing going on with an outdated builtin configuration, I re-added this ml job with the prov… --- ## [Endpoint agent consistent 90+% CPU for some PCs](https://discuss.elastic.co/t/endpoint-agent-consistent-90-cpu-for-some-pcs/260693)
**Author:** [@The1WhoPrtNocks](https://discuss.elastic.co/u/The1WhoPrtNocks)\ **Replies:** 15\ **Last updated:** [February 17, 2021, 4:03pm UTC](https://discuss.elastic.co/t/endpoint-agent-consistent-90-cpu-for-some-pcs/260693 "2021-02-17T16:03:37Z")
Hi, I have recently been rolling our the Elastic Endpoint Agent to some clients for testing. As part of the policy they are pushed Endpoint Security, System and Windows. For certain clients they are getting consistent… --- ## [Endpoint security rules](https://discuss.elastic.co/t/endpoint-security-rules/264410)
**Author:** [@Dan\_Kennedy](https://discuss.elastic.co/u/Dan_Kennedy)\ **Replies:** 4\ **Last updated:** [February 16, 2021, 5:01pm UTC](https://discuss.elastic.co/t/endpoint-security-rules/264410 "2021-02-16T17:01:51Z")
Running 7.11 in Elastic Cloud and the endpoint agent and noticed all endpoint security rules are failing due to The following index patterns did not match any indices: \["endgame-\*"\] I do not have this indices, should I… --- ## [Security agent tuning](https://discuss.elastic.co/t/security-agent-tuning/264406)
**Author:** [@Dan\_Kennedy](https://discuss.elastic.co/u/Dan_Kennedy)\ **Replies:** 2\ **Last updated:** [February 16, 2021, 3:51pm UTC](https://discuss.elastic.co/t/security-agent-tuning/264406 "2021-02-16T15:51:36Z")
I have the agent running on some Linux servers and it generates about 15M process events within a 24 hour period. Is there a way to tune this as its consumes a lot of storage with data that is not very useful. Also, are… --- ## [ELK 7.10 - Indicator index patterns: Value lists](https://discuss.elastic.co/t/elk-7-10-indicator-index-patterns-value-lists/264287)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 2\ **Last updated:** [February 15, 2021, 4:22pm UTC](https://discuss.elastic.co/t/elk-7-10-indicator-index-patterns-value-lists/264287 "2021-02-15T16:22:24Z")
Hello, I am trying to create a indicator match rule in ELK 7.10 where i have to give the indicator index pattern. Is there any default indicator index in ELK 7.10 or do i need to create a new indicator index with IOC lo… --- ## [How to give access to Security Cases of one Kibana Space to the users in another Kibana Space?](https://discuss.elastic.co/t/how-to-give-access-to-security-cases-of-one-kibana-space-to-the-users-in-another-kibana-space/264032)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [February 12, 2021, 2:38pm UTC](https://discuss.elastic.co/t/how-to-give-access-to-security-cases-of-one-kibana-space-to-the-users-in-another-kibana-space/264032 "2021-02-12T14:38:07Z")
Hello, Is it possible to give access to Security Cases of one Kibana Space to the users in another Kibana Space? For example we have an engineer team Kibana where the detections are running, but our security officers a… --- ## [Managing SIEM rules is harder then it should](https://discuss.elastic.co/t/managing-siem-rules-is-harder-then-it-should/263864)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 2\ **Last updated:** [February 11, 2021, 2:40pm UTC](https://discuss.elastic.co/t/managing-siem-rules-is-harder-then-it-should/263864 "2021-02-11T14:40:44Z")
Hello, I'd like to make some suggestions about the Elastic SIEM rule management. Monday we had a major hardware failure of a network card of on of our hot data nodes. The node in particular was not completely offline a… --- ## [Issue with Endpoint agent](https://discuss.elastic.co/t/issue-with-endpoint-agent/261610)
**Author:** [@trixrahbit](https://discuss.elastic.co/u/trixrahbit)\ **Replies:** 6\ **Last updated:** [February 10, 2021, 12:30am UTC](https://discuss.elastic.co/t/issue-with-endpoint-agent/261610 "2021-02-10T00:30:18Z")
I finally got everything setup for my stack but the endpoints are generating a "Failed to download or validate user artifacts error. " I cant seem to find anything on this. Could anyone point me in the right direction? … --- ## [Best specification server](https://discuss.elastic.co/t/best-specification-server/262585)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 6\ **Last updated:** [February 8, 2021, 6:03pm UTC](https://discuss.elastic.co/t/best-specification-server/262585 "2021-02-08T18:03:33Z")
hi guys, i have a project to make a SIEM using ELK. and it will be separate 5 server. 3 server for Elasticsearch, 1 server for Kibana, and 1 server for Logstash can you guys help me with the most ideal spec for all the… --- ## [Elastic SIEM - Detection Rules - Combination of Time-based, Threshold, Aggregation and Sequence Events](https://discuss.elastic.co/t/elastic-siem-detection-rules-combination-of-time-based-threshold-aggregation-and-sequence-events/263175)
**Author:** [@tushar.bansal](https://discuss.elastic.co/u/tushar.bansal)\ **Replies:** 6\ **Last updated:** [February 5, 2021, 6:11pm UTC](https://discuss.elastic.co/t/elastic-siem-detection-rules-combination-of-time-based-threshold-aggregation-and-sequence-events/263175 "2021-02-05T18:11:20Z")
How to create rule to detect: "Successful Brute Force Attack" (When more than 10 Windows logout events (ID 4625) occur AND followed by a Windows login event (ID 4624) on a same host) in 5 minutes timespan Thresholds: N… --- ## [Elastic SIEM - Detection Rules - Multiple Thresholds in a Rule](https://discuss.elastic.co/t/elastic-siem-detection-rules-multiple-thresholds-in-a-rule/263411)
**Author:** [@tushar.bansal](https://discuss.elastic.co/u/tushar.bansal)\ **Replies:** 0\ **Last updated:** [February 5, 2021, 3:11pm UTC](https://discuss.elastic.co/t/elastic-siem-detection-rules-multiple-thresholds-in-a-rule/263411 "2021-02-05T15:11:01Z")
Is there a way to apply multiple Thresholds in a single rule? example: More than 10 Identical event.actions on more than 10 destination.hostnames in a span of 10 minutes Threshold 1: Results aggregated by event.action… --- ## [Customize SIEM Detection columns based on alert](https://discuss.elastic.co/t/customize-siem-detection-columns-based-on-alert/263228)
**Author:** [@madduck](https://discuss.elastic.co/u/madduck)\ **Replies:** 1\ **Last updated:** [February 5, 2021, 2:57pm UTC](https://discuss.elastic.co/t/customize-siem-detection-columns-based-on-alert/263228 "2021-02-05T14:57:41Z")
Hello, it seems like the Columns in the SIEM Application are more or less static and if I want a new value to de displayed I have to add it to the entire mask which might lead to unpopulated fields in certain alerts. T… --- ## [Elastic Agent 7.10.1 : javax.net.ssl.SSLHandshakeException: Received fatal alert: bad\_certificate](https://discuss.elastic.co/t/elastic-agent-7-10-1-javax-net-ssl-sslhandshakeexception-received-fatal-alert-bad-certificate/260607)
**Author:** [@hilo21](https://discuss.elastic.co/u/hilo21)\ **Replies:** 2\ **Last updated:** [February 3, 2021, 3:42pm UTC](https://discuss.elastic.co/t/elastic-agent-7-10-1-javax-net-ssl-sslhandshakeexception-received-fatal-alert-bad-certificate/260607 "2021-02-03T15:42:36Z")
Hello, I was testing the latest version of Elastic Stack 7.10.1. So far, so far following the documentation I managed setup an test environment and setup a small lab. I am interested in testing (Simulating Attacks) on … --- ## [Detection Rules: Time Frame Based Exceptions](https://discuss.elastic.co/t/detection-rules-time-frame-based-exceptions/263036)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 4\ **Last updated:** [February 3, 2021, 2:46pm UTC](https://discuss.elastic.co/t/detection-rules-time-frame-based-exceptions/263036 "2021-02-03T14:46:25Z")
Hi All, I was wondering if it's possible to added time based exceptions to detection rules? An example would be with some of the current detection rules, they get triggered during system patching. Ideally it would be ni… --- ## [ML job - detect new port](https://discuss.elastic.co/t/ml-job-detect-new-port/263107)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 2\ **Last updated:** [February 3, 2021, 11:58am UTC](https://discuss.elastic.co/t/ml-job-detect-new-port/263107 "2021-02-03T11:58:39Z")
Hi, I am sending vulnerability scan results into the SIEM and trying to detect new ports scanned for an assest. Ive tried using Rare, by field: port and partition: asset but the results are coming back empty. It could… --- ## [SIEM Rule Failures](https://discuss.elastic.co/t/siem-rule-failures/260409)
**Author:** [@Ameer\_Mukadam](https://discuss.elastic.co/u/Ameer_Mukadam)\ **Replies:** 5\ **Last updated:** [February 1, 2021, 9:39pm UTC](https://discuss.elastic.co/t/siem-rule-failures/260409 "2021-02-01T21:39:14Z")
Hello Everyone, We are on Elastic 7.9 and are mainly using it as a SIEM, suddenly all of the SIEM rules start to fail and not just some but all of them. --- ## [MISP and Elastic Security](https://discuss.elastic.co/t/misp-and-elastic-security/257644)
**Author:** [@Ameer\_Mukadam](https://discuss.elastic.co/u/Ameer_Mukadam)\ **Replies:** 15\ **Last updated:** [January 30, 2021, 8:45am UTC](https://discuss.elastic.co/t/misp-and-elastic-security/257644 "2021-01-30T08:45:20Z")
I have a use case where I want to index attributes from MISP to Elasticsearch for using the new Threat Matching rule in Elastic Security 7.10. Everything is working fine but the issue is when I try to ingest more attrib… --- ## [Bulk indexing of signals failed in Kibana 7.10.2](https://discuss.elastic.co/t/bulk-indexing-of-signals-failed-in-kibana-7-10-2/262373)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 7\ **Last updated:** [January 29, 2021, 9:29pm UTC](https://discuss.elastic.co/t/bulk-indexing-of-signals-failed-in-kibana-7-10-2/262373 "2021-01-29T21:29:30Z")
Hello, Just noticed our custom SIEM rules seem to throw errors, such as: Bulk Indexing of signals failed: reason: "No mapping found for \[@timestamp\] in order to sort on" type: "query\_shard\_exception" name: "Elastic Aud… --- ## [Action export selected signals to csv](https://discuss.elastic.co/t/action-export-selected-signals-to-csv/262497)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 7\ **Last updated:** [January 29, 2021, 4:04pm UTC](https://discuss.elastic.co/t/action-export-selected-signals-to-csv/262497 "2021-01-29T16:04:29Z")
hello, Just a thought for a SIEM feature. We have colleagues with limited or no acces to Elastic / Kibana. But sometimes they do need to get a list of some signals. Imho it would be super handy to be able to quickly exp… --- ## [Detection Rules Fail Index issues](https://discuss.elastic.co/t/detection-rules-fail-index-issues/261689)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 8\ **Last updated:** [January 29, 2021, 12:24am UTC](https://discuss.elastic.co/t/detection-rules-fail-index-issues/261689 "2021-01-29T00:24:40Z")
So the cluster has been running for about 2 months no issues or changes. Recently within the past 5 days: Bulk Indexing of signals failed: reason: "No mapping found for \[@timestamp\] in order to sort on" type: "query\_sha… --- ## [Recommended practise for detection tuning; filters or exceptions](https://discuss.elastic.co/t/recommended-practise-for-detection-tuning-filters-or-exceptions/262218)
**Author:** [@The1WhoPrtNocks](https://discuss.elastic.co/u/The1WhoPrtNocks)\ **Replies:** 7\ **Last updated:** [January 28, 2021, 12:36pm UTC](https://discuss.elastic.co/t/recommended-practise-for-detection-tuning-filters-or-exceptions/262218 "2021-01-28T12:36:27Z")
Hi, I have given a look through the documentation but did not come across anything conclusive. What is the recommended way of tuning detection rules, as you can get the same results from filters and exceptions. Can yo… [Previous page](https://discuss.elastic.co/c/security/83.md?page=50) [Next page](https://discuss.elastic.co/c/security/83.md?page=52)