# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=52 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 53 --- ## [TSL/SSL basic license for ES Versions 7+](https://discuss.elastic.co/t/tsl-ssl-basic-license-for-es-versions-7/262445)
**Author:** [@pemfir](https://discuss.elastic.co/u/pemfir)\ **Replies:** 1\ **Last updated:** [January 28, 2021, 4:59am UTC](https://discuss.elastic.co/t/tsl-ssl-basic-license-for-es-versions-7/262445 "2021-01-28T04:59:38Z")
i tried to setup user-name and password for my single node ElasticSearch-kibana clusters using the instructions below, but it seems this is not possible without first setting up TSL/SSL, which will enable communication w… --- ## [Windows local Firewall management](https://discuss.elastic.co/t/windows-local-firewall-management/262277)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 2\ **Last updated:** [January 26, 2021, 9:01pm UTC](https://discuss.elastic.co/t/windows-local-firewall-management/262277 "2021-01-26T21:01:58Z")
Hello, Most EDR's offer integrated Windows Firewall management. Is that something that is on the Elastic Endpoint Security roadmap? Grtz Willem --- ## [I have problem method path: POST](https://discuss.elastic.co/t/i-have-problem-method-path-post/262222)
**Author:** [@wanindyz](https://discuss.elastic.co/u/wanindyz)\ **Replies:** 0\ **Last updated:** [January 26, 2021, 10:58am UTC](https://discuss.elastic.co/t/i-have-problem-method-path-post/262222 "2021-01-26T10:58:39Z")
DEBUG kibana/client.go:170 Request method: POST, path: /api/ingest\_manager/fleet/agents/enroll and no data hosts show this page --- ## [DataStream vs detection rules](https://discuss.elastic.co/t/datastream-vs-detection-rules/261563)
**Author:** [@Charles100](https://discuss.elastic.co/u/Charles100)\ **Replies:** 2\ **Last updated:** [January 21, 2021, 5:32am UTC](https://discuss.elastic.co/t/datastream-vs-detection-rules/261563 "2021-01-21T05:32:29Z")
Hi, I'm testing datastreams right now and observed that default detection rules are not looking logs from my datastreams indices. Do I have to manually change all default rules (and new ones added by updates) to include… --- ## [Event.action field for cloudTrail logs not being assigned event name when pulling cloud-trail logs using aws module](https://discuss.elastic.co/t/event-action-field-for-cloudtrail-logs-not-being-assigned-event-name-when-pulling-cloud-trail-logs-using-aws-module/261621)
**Author:** [@kbirhan](https://discuss.elastic.co/u/kbirhan)\ **Replies:** 0\ **Last updated:** [January 20, 2021, 8:16am UTC](https://discuss.elastic.co/t/event-action-field-for-cloudtrail-logs-not-being-assigned-event-name-when-pulling-cloud-trail-logs-using-aws-module/261621 "2021-01-20T08:16:35Z")
Hi I was looking into my cloudtrail logs i am pulling from s3 bucket, and it seems aws module of filebeat seems to give a generic value ("mangement") for the event.action field. As shown in the image,all event.action fi… --- ## [\[SIEM\] Authentications table doesn't show 'Last Success/Failed Source' column if only 'source.ip' is present](https://discuss.elastic.co/t/siem-authentications-table-doesnt-show-last-success-failed-source-column-if-only-source-ip-is-present/261257)
**Author:** [@eextreemee](https://discuss.elastic.co/u/eextreemee)\ **Replies:** 6\ **Last updated:** [January 19, 2021, 5:25pm UTC](https://discuss.elastic.co/t/siem-authentications-table-doesnt-show-last-success-failed-source-column-if-only-source-ip-is-present/261257 "2021-01-19T17:25:17Z")
I found solution here but i don't know how to implement it. please help... --- ## [\[ Creating new rule \]: ERROR Authentication using apikey failed - api key has been invalidated](https://discuss.elastic.co/t/creating-new-rule-error-authentication-using-apikey-failed-api-key-has-been-invalidated/261407)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 4\ **Last updated:** [January 19, 2021, 4:53pm UTC](https://discuss.elastic.co/t/creating-new-rule-error-authentication-using-apikey-failed-api-key-has-been-invalidated/261407 "2021-01-19T16:53:45Z")
Hello, I am using elasticsearch, kibana and beats version 7.10.1 with a Trial license, I am trying to create a new Match rule and in my elasticsearch node I am getting this error: \[2021-01-18T11:33:18,032\]\[WARN \]\[o.e… --- ## [\[ URLHaus threat intelligence \]: create a new rule](https://discuss.elastic.co/t/urlhaus-threat-intelligence-create-a-new-rule/260857)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 17\ **Last updated:** [January 19, 2021, 2:49pm UTC](https://discuss.elastic.co/t/urlhaus-threat-intelligence-create-a-new-rule/260857 "2021-01-19T14:49:23Z")
Hello, I am using logsatsh to enrich my SIEM with malicious Urls that I downloaded from URLHaus, and I wanna create a rule that send an alert everytime a user connect to one of the malicious urls. The problem is that … --- ## [Why \`elastic-es-default-0\` (which is the pod name for my Elasticsearch) becomes a "host"?](https://discuss.elastic.co/t/why-elastic-es-default-0-which-is-the-pod-name-for-my-elasticsearch-becomes-a-host/261490)
**Author:** [@fzyzcjy](https://discuss.elastic.co/u/fzyzcjy)\ **Replies:** 1\ **Last updated:** [January 19, 2021, 2:12pm UTC](https://discuss.elastic.co/t/why-elastic-es-default-0-which-is-the-pod-name-for-my-elasticsearch-becomes-a-host/261490 "2021-01-19T14:12:08Z")
It behaves like a host... For example, see the screenshot. The test-one-01106 is a real kubernetes worker machine, but the elastic-es-default-0 is not... Thanks! --- ## [Signal.rule.name empty?](https://discuss.elastic.co/t/signal-rule-name-empty/260823)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 6\ **Last updated:** [January 18, 2021, 7:08pm UTC](https://discuss.elastic.co/t/signal-rule-name-empty/260823 "2021-01-18T19:08:22Z")
Hello, Just noticed signal.rule.name is empty for some rules? Elastic 7.9.2 The above screenshot is from the rule "VNC to the Internet" which I copied from the official " VNC (Virtual Network Computing) to the Intern… --- ## [Elastic Detections permissions issues](https://discuss.elastic.co/t/elastic-detections-permissions-issues/257751)
**Author:** [@yarooski](https://discuss.elastic.co/u/yarooski)\ **Replies:** 6\ **Last updated:** [January 18, 2021, 6:59pm UTC](https://discuss.elastic.co/t/elastic-detections-permissions-issues/257751 "2021-01-18T18:59:29Z")
We are new to elastic and are working to get detections up and running. I created a role with all the required permissions according to the documentation and assigned it to my user, but when going to the detections page … --- ## [Attribute detection to original doc](https://discuss.elastic.co/t/attribute-detection-to-original-doc/261010)
**Author:** [@Samsquantch](https://discuss.elastic.co/u/Samsquantch)\ **Replies:** 1\ **Last updated:** [January 18, 2021, 6:51pm UTC](https://discuss.elastic.co/t/attribute-detection-to-original-doc/261010 "2021-01-18T18:51:53Z")
Is there a way to include the original \_id of the doc that triggered an alert in the metadata of a detection? When working IR, we would like to efficiently trace an alert to an event. I can create a filter based off of … --- ## [Elastic Agent - Indeces](https://discuss.elastic.co/t/elastic-agent-indeces/260745)
**Author:** [@blcyb](https://discuss.elastic.co/u/blcyb)\ **Replies:** 2\ **Last updated:** [January 16, 2021, 12:01pm UTC](https://discuss.elastic.co/t/elastic-agent-indeces/260745 "2021-01-16T12:01:25Z")
Is it possible to send Elastic Agent data based on the policy applied to it or namespace when deployed via fleet? E.g. Group 1 sensors have data sent to a specfic set of indices specifically for group 2 and the same for … --- ## [\[ Threshold Rule \]: Unexpected result](https://discuss.elastic.co/t/threshold-rule-unexpected-result/260956)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 5\ **Last updated:** [January 14, 2021, 3:53pm UTC](https://discuss.elastic.co/t/threshold-rule-unexpected-result/260956 "2021-01-14T15:53:47Z")
Hello, I would like to create a Threshold rule to detect files downloaded more than 1 Go. So in my firewall logs I have the field rcvd where I can find this value, and I to test that, I tested to download a file with 1… --- ## [Indicator match - limit indicator look back time](https://discuss.elastic.co/t/indicator-match-limit-indicator-look-back-time/260867)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 3\ **Last updated:** [January 13, 2021, 5:21pm UTC](https://discuss.elastic.co/t/indicator-match-limit-indicator-look-back-time/260867 "2021-01-13T17:21:39Z")
Hi, Within a indicator match detection, for the indicator index query are we able to modify how far that looks back within that index? --- ## [Endpoints are enrolling stuck message](https://discuss.elastic.co/t/endpoints-are-enrolling-stuck-message/258599)
**Author:** [@VictorG](https://discuss.elastic.co/u/VictorG)\ **Replies:** 19\ **Last updated:** [January 13, 2021, 2:33pm UTC](https://discuss.elastic.co/t/endpoints-are-enrolling-stuck-message/258599 "2021-01-13T14:33:19Z")
Hi Elastic team, I am currently running the latest version of Elastic Agent which is enrolled in the fleet but I don't see any endpoint enrolled yet. The message I get for a few days now in Security/Detections/Administr… --- ## [Hyphens in queries are ignored on Powershell Logs collected by Elastic Agent and Winlogbeat](https://discuss.elastic.co/t/hyphens-in-queries-are-ignored-on-powershell-logs-collected-by-elastic-agent-and-winlogbeat/259537)
**Author:** [@j0nh](https://discuss.elastic.co/u/j0nh)\ **Replies:** 3\ **Last updated:** [January 13, 2021, 8:56am UTC](https://discuss.elastic.co/t/hyphens-in-queries-are-ignored-on-powershell-logs-collected-by-elastic-agent-and-winlogbeat/259537 "2021-01-13T08:56:07Z")
The Problem When dealing with Powershell Logs collected by both Elastic Agent and winlogbeat, I'm dealing with the following problem: Hyphens are ignored and contains queries don't work properly For example: Queries… --- ## [Questions re elksiem](https://discuss.elastic.co/t/questions-re-elksiem/260561)
**Author:** [@rconroy](https://discuss.elastic.co/u/rconroy)\ **Replies:** 33\ **Last updated:** [January 12, 2021, 7:19pm UTC](https://discuss.elastic.co/t/questions-re-elksiem/260561 "2021-01-12T19:19:14Z")
OK, so first off, the auditbeats install, one reference had me use the downloaded files ./auditbeat setup method, whereas the other had me install using yum. The yum method didnt appear to install any dashboards and the… --- ## [Detection Rules Column Data Missing](https://discuss.elastic.co/t/detection-rules-column-data-missing/260434)
**Author:** [@Psyhil](https://discuss.elastic.co/u/Psyhil)\ **Replies:** 2\ **Last updated:** [January 12, 2021, 9:47am UTC](https://discuss.elastic.co/t/detection-rules-column-data-missing/260434 "2021-01-12T09:47:31Z")
Good Day! I have added some custom rules in elastic and running into a problem where fields like host.name, Source IP address and destination IP address are missing in detections UI. I tried to fiddle with the columns … --- ## [Endpoint Security agents online but not sending any logs](https://discuss.elastic.co/t/endpoint-security-agents-online-but-not-sending-any-logs/260618)
**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\ **Replies:** 1\ **Last updated:** [January 11, 2021, 2:29pm UTC](https://discuss.elastic.co/t/endpoint-security-agents-online-but-not-sending-any-logs/260618 "2021-01-11T14:29:51Z")
Hello, I hope this message finds you healthy and safe. I am trying to gather logs through Elastic Endpoint Security. I can see the agents online and heartbeats with payload: \`\` { "endpoint-security": { "@timestamp"… --- ## [Endpoint Security Network Events Missing & Not Parsing Data](https://discuss.elastic.co/t/endpoint-security-network-events-missing-not-parsing-data/259982)
**Author:** [@Man715](https://discuss.elastic.co/u/Man715)\ **Replies:** 2\ **Last updated:** [January 8, 2021, 4:07am UTC](https://discuss.elastic.co/t/endpoint-security-network-events-missing-not-parsing-data/259982 "2021-01-08T04:07:00Z")
I am running into two issues with the Network Events. The first issue is that HTTPS traffic is not getting identified as HTTPS traffic and is has an empty http.request.body.content and most HTTP traffic is the same. … --- ## [Fleet enrollment is done but doesn't appear on Security \> Administration \> Endpoints](https://discuss.elastic.co/t/fleet-enrollment-is-done-but-doesnt-appear-on-security-administration-endpoints/260142)
**Author:** [@roh](https://discuss.elastic.co/u/roh)\ **Replies:** 5\ **Last updated:** [January 7, 2021, 9:00am UTC](https://discuss.elastic.co/t/fleet-enrollment-is-done-but-doesnt-appear-on-security-administration-endpoints/260142 "2021-01-07T09:00:57Z")
Hi all! I'm trying to enroll Elastic Agent on Fleet. Kibana and Elasticsearch are on Windows 10 WSL Ubuntu 16.04 and Elastic Agent is on Windows 10. I'm using self-signed certs so I imported certificates as root trust… --- ## [Elastic Endpoint not showing up error](https://discuss.elastic.co/t/elastic-endpoint-not-showing-up-error/259327)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 5\ **Last updated:** [January 6, 2021, 3:53am UTC](https://discuss.elastic.co/t/elastic-endpoint-not-showing-up-error/259327 "2021-01-06T03:53:06Z")
Hi all I have been trying out the elastic endpoint security since yesterday and i have been having some issue with it. So there are a few question i have to address in order to work this out: How to set the ssl to sen… --- ## [Stopping Elastic Endpoint service](https://discuss.elastic.co/t/stopping-elastic-endpoint-service/260027)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 3\ **Last updated:** [January 6, 2021, 12:19am UTC](https://discuss.elastic.co/t/stopping-elastic-endpoint-service/260027 "2021-01-06T00:19:58Z")
Hello, While testing with Elastic Endpoint on my home Windows 10, I noticed I can stop the service with no issue at all. Service Name: ElasticEndpoint What would stop a bad actor from stopping the service? if I rememb… --- ## [Multiple Different Clients](https://discuss.elastic.co/t/multiple-different-clients/258935)
**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Replies:** 4\ **Last updated:** [January 4, 2021, 7:25pm UTC](https://discuss.elastic.co/t/multiple-different-clients/258935 "2021-01-04T19:25:00Z")
Is it possible to use a single instance of Elastic SIEM to monitor two different companies networks and separate them so their information will be separated? --- ## [Stuck on "going to run"](https://discuss.elastic.co/t/stuck-on-going-to-run/258262)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 7\ **Last updated:** [January 4, 2021, 7:14pm UTC](https://discuss.elastic.co/t/stuck-on-going-to-run/258262 "2021-01-04T19:14:05Z")
I have a detection rule that looks for indicator matches on a filebeat-misp index and every so often it will get stuck on "going to run" with a date that is in the past. If it is failing then I'm none the wiser but I'd … --- ## [ELastic Endpoint Security Agent not visible in Kibana Security App](https://discuss.elastic.co/t/elastic-endpoint-security-agent-not-visible-in-kibana-security-app/259631)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 2\ **Last updated:** [January 4, 2021, 3:49pm UTC](https://discuss.elastic.co/t/elastic-endpoint-security-agent-not-visible-in-kibana-security-app/259631 "2021-01-04T15:49:14Z")
Hello, Tried to install an Elastic Agent on my home Windows 10. Deployed the Agent through fleet. with a system, windows and endpoint policy. But when I go to Security Administration, it says "Endpoints are enrollin… --- ## [Indicator false match on ipv6](https://discuss.elastic.co/t/indicator-false-match-on-ipv6/258521)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 6\ **Last updated:** [January 4, 2021, 2:10am UTC](https://discuss.elastic.co/t/indicator-false-match-on-ipv6/258521 "2021-01-04T02:10:06Z")
I received a ipv6 match (destination.ip) from an indicator however the destination ip doesn't exist in my threat intel feed! I've linked my detection rule, the match event as well as the CSV of the threat intel feed (al… --- ## [Runing Elastic Endpoint Security tohether with MS Defender](https://discuss.elastic.co/t/runing-elastic-endpoint-security-tohether-with-ms-defender/259252)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 2\ **Last updated:** [January 3, 2021, 12:11pm UTC](https://discuss.elastic.co/t/runing-elastic-endpoint-security-tohether-with-ms-defender/259252 "2021-01-03T12:11:51Z")
Hello, Is it supported / allowed to run Elastic Endpoint Security and the free builtin Windows Defender together on a host? --- ## [Elastic Endpoint Expected CPU Usage](https://discuss.elastic.co/t/elastic-endpoint-expected-cpu-usage/259889)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 6\ **Last updated:** [January 2, 2021, 4:29pm UTC](https://discuss.elastic.co/t/elastic-endpoint-expected-cpu-usage/259889 "2021-01-02T16:29:18Z")
Hello, I've been playing around with Elastic Endpoint lately on my home Windows 10 pc, which has 4 CPU cores. I see that the elastic-endpoint.exe process is using around 24 % Normalized CPU: I'm just wondering if thi… [Previous page](https://discuss.elastic.co/c/security/83.md?page=51) [Next page](https://discuss.elastic.co/c/security/83.md?page=53)