# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=53 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 54 --- ## [Exclude event that endpoint security send to elasticsearch](https://discuss.elastic.co/t/exclude-event-that-endpoint-security-send-to-elasticsearch/259621)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 2\ **Last updated:** [December 31, 2020, 2:11am UTC](https://discuss.elastic.co/t/exclude-event-that-endpoint-security-send-to-elasticsearch/259621 "2020-12-31T02:11:29Z")
Hi all i have been trying elastic agent endpoint for sometime. So i notices that endpoint mornitor for file is really large. like it logs even when i create a file and tmp file which can generate a lots of logs that is… --- ## [Error using Endpoint Security in Linux](https://discuss.elastic.co/t/error-using-endpoint-security-in-linux/259316)
**Author:** [@roh](https://discuss.elastic.co/u/roh)\ **Replies:** 6\ **Last updated:** [December 29, 2020, 6:11pm UTC](https://discuss.elastic.co/t/error-using-endpoint-security-in-linux/259316 "2020-12-29T18:11:10Z")
Hi all I was testing Elastic Agent with Endpoint Security policy. I thought only malware protection doesn't work in linux, but I get this error when I try to use Endpoint Security. I also tried Endpoint Security pol… --- ## [Elastic-agent install speling error](https://discuss.elastic.co/t/elastic-agent-install-speling-error/259539)
**Author:** [@ml4](https://discuss.elastic.co/u/ml4)\ **Replies:** 1\ **Last updated:** [December 29, 2020, 5:54am UTC](https://discuss.elastic.co/t/elastic-agent-install-speling-error/259539 "2020-12-29T05:54:41Z")
I used sudo elastic-agent-7.10.1-linux-x86\_64/elastic-agent install -f --kibana-url=${KIBANA\_URL} --enrollment-token=${ENROLMENT\_TOKEN} to install my linux VM. Note the flag enrollment is misspelt. As youre in beta, y… --- ## [SIEM detection rule emails body customization](https://discuss.elastic.co/t/siem-detection-rule-emails-body-customization/258416)
**Author:** [@ajesh](https://discuss.elastic.co/u/ajesh)\ **Replies:** 4\ **Last updated:** [December 28, 2020, 9:19pm UTC](https://discuss.elastic.co/t/siem-detection-rule-emails-body-customization/258416 "2020-12-28T21:19:47Z")
Hi Team, Can you please let me know how i can add additional details to detection rules message body For example , for root login attempt failure , i need the email message body with host.hostname, @timestamp, event.o… --- ## [App allowed through elastic endpoint due to message processing error](https://discuss.elastic.co/t/app-allowed-through-elastic-endpoint-due-to-message-processing-error/259556)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 4\ **Last updated:** [December 28, 2020, 9:11pm UTC](https://discuss.elastic.co/t/app-allowed-through-elastic-endpoint-due-to-message-processing-error/259556 "2020-12-28T21:11:37Z")
Hi all. I have been trying to use elastic endpoint sec since yesterday and the agent on windows having some problems that i dont really know how to fix. It constantly say that some app or dll lib is allowed due to mess… --- ## [Missing geo\_point field](https://discuss.elastic.co/t/missing-geo-point-field/257577)
**Author:** [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Replies:** 13\ **Last updated:** [December 28, 2020, 9:00pm UTC](https://discuss.elastic.co/t/missing-geo-point-field/257577 "2020-12-28T21:00:49Z")
Hi, I'm experiencing this issue on a fresh ELK 7.10 installation. I just deployed the Elastic-Agent with the only integration Endpoint , not even system . Is there a solution or workaround available or this is still und… --- ## [Suricata Rule](https://discuss.elastic.co/t/suricata-rule/259666)
**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Replies:** 0\ **Last updated:** [December 26, 2020, 5:43pm UTC](https://discuss.elastic.co/t/suricata-rule/259666 "2020-12-26T17:43:19Z")
Is there some type of general Suricata rule for Elastic that will create a detection alert in Elastic SIEM everytime that the suricata rules goes off. --- ## [Detection Alerts - Want To Only See that Alert](https://discuss.elastic.co/t/detection-alerts-want-to-only-see-that-alert/259135)
**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Replies:** 7\ **Last updated:** [December 24, 2020, 9:17am UTC](https://discuss.elastic.co/t/detection-alerts-want-to-only-see-that-alert/259135 "2020-12-24T09:17:42Z")
When clicking on a detection alert it shows the list with a list of other detections during a timeframe is there a way we can make it so it only shows that specific alert and not a list of others. Like make that timefr… --- ## [Elastic-Agent Install Creating a ton of folders](https://discuss.elastic.co/t/elastic-agent-install-creating-a-ton-of-folders/257421)
**Author:** [@cwobuzz](https://discuss.elastic.co/u/cwobuzz)\ **Replies:** 2\ **Last updated:** [December 22, 2020, 10:17pm UTC](https://discuss.elastic.co/t/elastic-agent-install-creating-a-ton-of-folders/257421 "2020-12-22T22:17:15Z")
I got the elastic-agent to enroll using the follow command \>elastic-agent enroll https://localhost:5601 bHRPdUlIWUJSMzJvZjZwSktjbzQ6QUY0SmpvNFZSY1MxMUZCSk82S3ZRQQ -a \\\\wsl$\\docker-desktop-data\\version-pack-data\\communit… --- ## [Installing all of the Rules from GitHub](https://discuss.elastic.co/t/installing-all-of-the-rules-from-github/259304)
**Author:** [@AirJordan](https://discuss.elastic.co/u/AirJordan)\ **Replies:** 2\ **Last updated:** [December 22, 2020, 7:25pm UTC](https://discuss.elastic.co/t/installing-all-of-the-rules-from-github/259304 "2020-12-22T19:25:41Z")
I see there is a https://github.com/elastic/detection-rules. It seems like when I installed Endpoint Security and did generate rules it created a lot of the rules. Yeah some are still missing. Is there a way to get the l… --- ## [How to only send an alert when severity is high](https://discuss.elastic.co/t/how-to-only-send-an-alert-when-severity-is-high/259263)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 5\ **Last updated:** [December 22, 2020, 6:40pm UTC](https://discuss.elastic.co/t/how-to-only-send-an-alert-when-severity-is-high/259263 "2020-12-22T18:40:59Z")
Hello, So I created this rule that triggers on Azure risky signins: Ans as you can see I made an override for the azure.signinlogs.properties.risk\_level\_during\_signin field. But now the alert I configured triggers o… --- ## [Does Protections and settings work separately in Endpoint Security integration?](https://discuss.elastic.co/t/does-protections-and-settings-work-separately-in-endpoint-security-integration/259318)
**Author:** [@roh](https://discuss.elastic.co/u/roh)\ **Replies:** 1\ **Last updated:** [December 22, 2020, 8:19am UTC](https://discuss.elastic.co/t/does-protections-and-settings-work-separately-in-endpoint-security-integration/259318 "2020-12-22T08:19:22Z")
Hi all! There's two configuration when you click Endpoint Security integration. One is "Protections" and the other one is "Settings". My question is : If you disable malware protection, does agent only collects events… --- ## [Opsgenie SIEM Case connector](https://discuss.elastic.co/t/opsgenie-siem-case-connector/257889)
**Author:** [@Felipe\_Fuller](https://discuss.elastic.co/u/Felipe_Fuller)\ **Replies:** 1\ **Last updated:** [December 22, 2020, 8:11am UTC](https://discuss.elastic.co/t/opsgenie-siem-case-connector/257889 "2020-12-22T08:11:04Z")
Hi! I'm trying to create a connector to push cases to Jira's Opsgenie from Elastic SIEM. Is it possible? The idea is to do the same that Jiras connector does, but adapted to Opsgenie. Thank you in advance! --- ## [GeoIP processing of detections](https://discuss.elastic.co/t/geoip-processing-of-detections/259319)
**Author:** [@p\_ansell](https://discuss.elastic.co/u/p_ansell)\ **Replies:** 0\ **Last updated:** [December 22, 2020, 1:34am UTC](https://discuss.elastic.co/t/geoip-processing-of-detections/259319 "2020-12-22T01:34:45Z")
Compared to non-Threshold results that inherit the previously processed fields, Threshold Detection events only include the single field that is being aggregated. I would like to perform GeoIP processing of Threshold Det… --- ## [X-pack security enable for tribe node](https://discuss.elastic.co/t/x-pack-security-enable-for-tribe-node/259129)
**Author:** [@prashanth\_sri](https://discuss.elastic.co/u/prashanth_sri)\ **Replies:** 4\ **Last updated:** [December 21, 2020, 9:45pm UTC](https://discuss.elastic.co/t/x-pack-security-enable-for-tribe-node/259129 "2020-12-21T21:45:26Z")
tribe: t1: cluster.name: Data1 discovery.zen.ping.unicast.hosts: \["x.x.x.x:9300"\] xpack.security.transport.ssl.verification\_mode: certificate xpack.security.transport.ssl.keystore.path: certs/estribe.p12 xpack.sec… --- ## [Elastic SIEM Fields Populate to JIRA Custom Fields](https://discuss.elastic.co/t/elastic-siem-fields-populate-to-jira-custom-fields/259291)
**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Replies:** 1\ **Last updated:** [December 21, 2020, 5:51pm UTC](https://discuss.elastic.co/t/elastic-siem-fields-populate-to-jira-custom-fields/259291 "2020-12-21T17:51:47Z")
Is it possible to populate fields to customer fields in JIRA for a ticket. Like my current set up that I have for AlienVault? --- ## [Custom Rules not working](https://discuss.elastic.co/t/custom-rules-not-working/258421)
**Author:** [@Yuriy\_Tsarenko](https://discuss.elastic.co/u/Yuriy_Tsarenko)\ **Replies:** 7\ **Last updated:** [December 16, 2020, 3:27pm UTC](https://discuss.elastic.co/t/custom-rules-not-working/258421 "2020-12-16T15:27:01Z")
Hello team! If possible, you could help us with setting up custom rules for SIEM. We had the following problem: The main idea is to create a rule according to which we would receive notifications when someone from the… --- ## [Elastic Endgame Fundamentals](https://discuss.elastic.co/t/elastic-endgame-fundamentals/258939)
**Author:** [@PASONI](https://discuss.elastic.co/u/PASONI)\ **Replies:** 1\ **Last updated:** [December 18, 2020, 4:24pm UTC](https://discuss.elastic.co/t/elastic-endgame-fundamentals/258939 "2020-12-18T16:24:40Z")
I have one doubt regarding Elastic Endgame Fundamentals Course. While doing the course in Lab 1 where I have to deploy the sensor, I am not getting the desired output. I tried everything to resolve the error but it is no… --- ## [Fleet not working anymore \[Unable to initialize Fleet\]](https://discuss.elastic.co/t/fleet-not-working-anymore-unable-to-initialize-fleet/258890)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 14\ **Last updated:** [December 18, 2020, 7:59am UTC](https://discuss.elastic.co/t/fleet-not-working-anymore-unable-to-initialize-fleet/258890 "2020-12-18T07:59:10Z")
Hello, I am trying elastic Endpoint under elastic and kibana version 8.0.0 (from source), and since few days I am geeting this error in my logs when I click on the Fleet on Kibana 404 Not Found' error response from pac… --- ## [No alert in security detection dashboards after malware attack](https://discuss.elastic.co/t/no-alert-in-security-detection-dashboards-after-malware-attack/258380)
**Author:** [@Diana\_Dragoiu](https://discuss.elastic.co/u/Diana_Dragoiu)\ **Replies:** 7\ **Last updated:** [December 17, 2020, 3:01pm UTC](https://discuss.elastic.co/t/no-alert-in-security-detection-dashboards-after-malware-attack/258380 "2020-12-17T15:01:17Z")
Hello ES team, After installing and enrolling Elastic Agent 7.10 we launched an Mimikatz.exe on our Win10 machine and received an ES Malware Alert but we do not receive an alert in Security Detections tab in Kibana. T… --- ## [MSSP SOC - How to ByPass "Cases"](https://discuss.elastic.co/t/mssp-soc-how-to-bypass-cases/255387)
**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Replies:** 5\ **Last updated:** [December 17, 2020, 10:01am UTC](https://discuss.elastic.co/t/mssp-soc-how-to-bypass-cases/255387 "2020-12-17T10:01:07Z")
I'm a SOC Engineer at a MSSP SOC and we currently use AlienVault for the majority of our clients, but we started to play around with Elastic SIEM and we just started to work with a potential new client and we have deploy… --- ## [Custom event category in correlation rule](https://discuss.elastic.co/t/custom-event-category-in-correlation-rule/258809)
**Author:** [@msszafar](https://discuss.elastic.co/u/msszafar)\ **Replies:** 4\ **Last updated:** [December 17, 2020, 7:48am UTC](https://discuss.elastic.co/t/custom-event-category-in-correlation-rule/258809 "2020-12-17T07:48:54Z")
Can anyone please explain what does it means I have Symantec antimalware logs on index pattern logstash-sepm\*. In json document I don't have event.category field but I want to create a correlation rule what if the sa… --- ## [Detection Alerts - Creating JIRA Ticket (Automatically)](https://discuss.elastic.co/t/detection-alerts-creating-jira-ticket-automatically/258930)
**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Replies:** 3\ **Last updated:** [December 17, 2020, 6:33am UTC](https://discuss.elastic.co/t/detection-alerts-creating-jira-ticket-automatically/258930 "2020-12-17T06:33:20Z")
I need to be able to find a way of using the Elastic SIEM API to create tickets in JIRA everytime a Detection Alert comes in. We are trying to basically skip the "CASE" portion of the SIEM too, because it doesn't work f… --- ## [Salesforce Login History into SIEM or Logstash](https://discuss.elastic.co/t/salesforce-login-history-into-siem-or-logstash/258796)
**Author:** [@involuntary-pretzel](https://discuss.elastic.co/u/involuntary-pretzel)\ **Replies:** 1\ **Last updated:** [December 17, 2020, 6:03am UTC](https://discuss.elastic.co/t/salesforce-login-history-into-siem-or-logstash/258796 "2020-12-17T06:03:40Z")
Hi there, I'm trying to get Salesforce Login History into the SIEM or at least into Logstash so I can ship it to Elasticsearch. I notice Logstash has a Salesforce Plugin, do you know if that has the ability to ship Logi… --- ## [Error installing Elastic-Agent v7.10.0](https://discuss.elastic.co/t/error-installing-elastic-agent-v7-10-0/258140)
**Author:** [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Replies:** 4\ **Last updated:** [December 16, 2020, 8:46pm UTC](https://discuss.elastic.co/t/error-installing-elastic-agent-v7-10-0/258140 "2020-12-16T20:46:32Z")
Hi, I am trying ELK 7.10.0 and it's beats. I have successfully installed the Elastic-Agent 7.10.0 in two machines, running Win 10 and Win 10 Pro, but I am unable to install the same agent on a machine running Windows Se… --- ## [Detection Actions fields](https://discuss.elastic.co/t/detection-actions-fields/258304)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 2\ **Last updated:** [December 15, 2020, 8:49am UTC](https://discuss.elastic.co/t/detection-actions-fields/258304 "2020-12-15T08:49:03Z")
Hi, Is there any update on using other fields from the signal to form the action other than the listed fields of {{context.rule.name}} etc. Thanks --- ## [Unusual Parent-Child Relationship Query and process parent hyphen value](https://discuss.elastic.co/t/unusual-parent-child-relationship-query-and-process-parent-hyphen-value/258570)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 3\ **Last updated:** [December 14, 2020, 7:18pm UTC](https://discuss.elastic.co/t/unusual-parent-child-relationship-query-and-process-parent-hyphen-value/258570 "2020-12-14T19:18:12Z")
Hello, I'm noticing a large amount of detections on the "Unusual Parent-Child Relationship" detection rule whichs seems to be related to the fact that some processes don't have a parent process. Data source are sysmon f… --- ## [Detection rules](https://discuss.elastic.co/t/detection-rules/257785)
**Author:** [@Cosmin\_Ciobanu1](https://discuss.elastic.co/u/Cosmin_Ciobanu1)\ **Replies:** 3\ **Last updated:** [December 14, 2020, 4:08pm UTC](https://discuss.elastic.co/t/detection-rules/257785 "2020-12-14T16:08:00Z")
How can I check when I make a detection rule if another rule has been activated? That is, if I want to make a rule that verifies an incident I would like to check if another rule that is strictly related to IDS has alrea… --- ## [Elastic agent fails under SysVinit due to dying endpoint security](https://discuss.elastic.co/t/elastic-agent-fails-under-sysvinit-due-to-dying-endpoint-security/257921)
**Author:** [@grin](https://discuss.elastic.co/u/grin)\ **Replies:** 2\ **Last updated:** [December 10, 2020, 6:48pm UTC](https://discuss.elastic.co/t/elastic-agent-fails-under-sysvinit-due-to-dying-endpoint-security/257921 "2020-12-10T18:48:32Z")
running operation 'operation-install' for endpoint-security.7.10.0 Failed to dispatch action 'action\_id: xxxxxxxxxxxxxxxx, type: POLICY\_CHANGE', error: operator: failed to execute step sc-run, error: operation '… --- ## [Rule failure for Windows path exclusions?](https://discuss.elastic.co/t/rule-failure-for-windows-path-exclusions/258034)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 4\ **Last updated:** [December 9, 2020, 3:26pm UTC](https://discuss.elastic.co/t/rule-failure-for-windows-path-exclusions/258034 "2020-12-09T15:26:20Z")
Hello, Elastic 7.9.2 Results in: The working directory values were autocompleted, so this seems weird that this throws an error. When I try to escape the '\\' autocomplete does not work. Grtz Willem [Previous page](https://discuss.elastic.co/c/security/83.md?page=52) [Next page](https://discuss.elastic.co/c/security/83.md?page=54)