# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=54 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 55 --- ## [Is it possible to create a new instance or cluster automatically after some number of space created?](https://discuss.elastic.co/t/is-it-possible-to-create-a-new-instance-or-cluster-automatically-after-some-number-of-space-created/257884)
**Author:** [@sunil\_petkar](https://discuss.elastic.co/u/sunil_petkar)\ **Replies:** 0\ **Last updated:** [December 7, 2020, 6:02pm UTC](https://discuss.elastic.co/t/is-it-possible-to-create-a-new-instance-or-cluster-automatically-after-some-number-of-space-created/257884 "2020-12-07T18:02:59Z")
Is it possible to create a new instance or cluster automatically after some number of space created? And add new space to new cluster / instance . Because we have 30K user and we can create max 1000 space for better p… --- ## [Microsoft 365 User Agent Field](https://discuss.elastic.co/t/microsoft-365-user-agent-field/257874)
**Author:** [@Gary\_Blackwell](https://discuss.elastic.co/u/Gary_Blackwell)\ **Replies:** 0\ **Last updated:** [December 7, 2020, 3:48pm UTC](https://discuss.elastic.co/t/microsoft-365-user-agent-field/257874 "2020-12-07T15:48:05Z")
I would like to be able to search Microsoft 365 user agents in the Elastic data for a couple of reasons. One, is that it helps me identify older protocols, for example CBAInPROD indicates POP or IMAP so I can recommend… --- ## [Microsoft 365 Detection Rule/Machine Learning Rule](https://discuss.elastic.co/t/microsoft-365-detection-rule-machine-learning-rule/257669)
**Author:** [@Gary\_Blackwell](https://discuss.elastic.co/u/Gary_Blackwell)\ **Replies:** 2\ **Last updated:** [December 7, 2020, 2:46pm UTC](https://discuss.elastic.co/t/microsoft-365-detection-rule-machine-learning-rule/257669 "2020-12-07T14:46:07Z")
I went through the detection rules under SIEM security and did not find any related to Office 365. I opened a Github request for rules related to "impossible logins", "foreign country logins" "new inbox rule created", a… --- ## [Elastic Endgame end to end Process on how to detect and eliminate threats](https://discuss.elastic.co/t/elastic-endgame-end-to-end-process-on-how-to-detect-and-eliminate-threats/257297)
**Author:** [@PatrickGeronimo](https://discuss.elastic.co/u/PatrickGeronimo)\ **Replies:** 2\ **Last updated:** [December 7, 2020, 1:45pm UTC](https://discuss.elastic.co/t/elastic-endgame-end-to-end-process-on-how-to-detect-and-eliminate-threats/257297 "2020-12-07T13:45:16Z")
Hi, I have been looking for End 2 End process of Elastic Endgame on how it detects and Eliminates threats, please help. thank you in advance --- ## [Auto response (Auto remediation) SIEM](https://discuss.elastic.co/t/auto-response-auto-remediation-siem/257665)
**Author:** [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\ **Replies:** 0\ **Last updated:** [December 4, 2020, 2:30pm UTC](https://discuss.elastic.co/t/auto-response-auto-remediation-siem/257665 "2020-12-04T14:30:54Z")
Hello everybody, I never used a webhook before, so I wanna know if it's possible for example to add automatic rules to my firewall when I detect an attack (brute force, port scanner ...). I have searched webinar for th… --- ## [Security Solution Plugins & @timestamp](https://discuss.elastic.co/t/security-solution-plugins-timestamp/257217)
**Author:** [@teej](https://discuss.elastic.co/u/teej)\ **Replies:** 1\ **Last updated:** [December 3, 2020, 1:31am UTC](https://discuss.elastic.co/t/security-solution-plugins-timestamp/257217 "2020-12-03T01:31:36Z")
Good Day, Just updated to 7.10 and while examining the kibana logs I find: {"type":"log","@timestamp":"2020-11-25T20:37:07Z","tags":\["error","plugins","securitySolution","plugins","securitySolution"\],"pid":22460,"messa… --- ## [SIEM - troubleshooting various error](https://discuss.elastic.co/t/siem-troubleshooting-various-error/257358)
**Author:** [@Colby99](https://discuss.elastic.co/u/Colby99)\ **Replies:** 1\ **Last updated:** [December 3, 2020, 1:27am UTC](https://discuss.elastic.co/t/siem-troubleshooting-various-error/257358 "2020-12-03T01:27:25Z")
Hello i have various error in the "Security" section. Starting by: The tab Overview: In the tab Hosts i got this 3 errors I'm using winlogbeat 7.10 and stack ELK 7.10 thank you for the help ! --- ## [External alerts via API](https://discuss.elastic.co/t/external-alerts-via-api/257293)
**Author:** [@Derick\_Jansen](https://discuss.elastic.co/u/Derick_Jansen)\ **Replies:** 1\ **Last updated:** [December 2, 2020, 12:26pm UTC](https://discuss.elastic.co/t/external-alerts-via-api/257293 "2020-12-02T12:26:21Z")
Hi I am using the /detection\_engine/signals/search endpoint to grab detections but this endpoint doesn't include External alerts (eg. Crowdstrike). Is there an endpoint or other method to programmatically collect extern… --- ## [Elastic detections and case sensitivity](https://discuss.elastic.co/t/elastic-detections-and-case-sensitivity/256788)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 4\ **Last updated:** [December 1, 2020, 8:31pm UTC](https://discuss.elastic.co/t/elastic-detections-and-case-sensitivity/256788 "2020-12-01T20:31:10Z")
We use logstash to lowercase most fields used in detections. I was hoping the new wildcard field type would get around the issue of case-insensitivity in the detections rules (not including EQL) Any recommendations or i… --- ## [Just a question about a siem rule filter](https://discuss.elastic.co/t/just-a-question-about-a-siem-rule-filter/256397)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 3\ **Last updated:** [November 30, 2020, 3:55pm UTC](https://discuss.elastic.co/t/just-a-question-about-a-siem-rule-filter/256397 "2020-11-30T15:55:27Z")
Hello, Just wondering what's the purpose of the extra info / metadata in the filter of for example: I can't find this info in the SIEM rule when I duplicate it: { "$state": { "store": "appState" },… --- ## [Malicious is reported in the zip file for windows platform](https://discuss.elastic.co/t/malicious-is-reported-in-the-zip-file-for-windows-platform/256707)
**Author:** [@dtln](https://discuss.elastic.co/u/dtln)\ **Replies:** 1\ **Last updated:** [November 30, 2020, 2:56pm UTC](https://discuss.elastic.co/t/malicious-is-reported-in-the-zip-file-for-windows-platform/256707 "2020-11-30T14:56:11Z")
I scan the zip file for windows platform which downloaded from (https://www.elastic.co/guide/en/elasticsearch/reference/current/getting-started-install.html) using virustotal. But it report that it has Malicious in it. … --- ## [Failed to close Detection alert](https://discuss.elastic.co/t/failed-to-close-detection-alert/256407)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 2\ **Last updated:** [November 30, 2020, 2:53pm UTC](https://discuss.elastic.co/t/failed-to-close-detection-alert/256407 "2020-11-30T14:53:41Z")
Hello, Version 7.9.2 I was trying to clean up / close some old alerts and I get the following error: Known issue? In the Kibana logs I find a 409: Request referrer: https://kiburl:5601/app/security/detections?f… --- ## [Auditbeat not logging started process that run very short](https://discuss.elastic.co/t/auditbeat-not-logging-started-process-that-run-very-short/255877)
**Author:** [@bertr](https://discuss.elastic.co/u/bertr)\ **Replies:** 1\ **Last updated:** [November 29, 2020, 1:42pm UTC](https://discuss.elastic.co/t/auditbeat-not-logging-started-process-that-run-very-short/255877 "2020-11-29T13:42:55Z")
The process dataset of the system module of auditbeat does not register short running processes. (version = 7.8.1). E.g. cat of small file will not show up in auditbeat index, cat of a bigger file will. Both cat's do sho… --- ## [What is the best practice to pseudonymize user data?](https://discuss.elastic.co/t/what-is-the-best-practice-to-pseudonymize-user-data/252573)
**Author:** [@elk51211](https://discuss.elastic.co/u/elk51211)\ **Replies:** 5\ **Last updated:** [November 26, 2020, 9:15pm UTC](https://discuss.elastic.co/t/what-is-the-best-practice-to-pseudonymize-user-data/252573 "2020-11-26T21:15:22Z")
What is the recommended approach to deal with logs to be as GDPR compliant as possible? I need to pseudonymize user data. The only resource I found is dated back to march of 2018 in this blog post: https://www.elastic.c… --- ## [Detection rule for password spraying attempts](https://discuss.elastic.co/t/detection-rule-for-password-spraying-attempts/256628)
**Author:** [@heading](https://discuss.elastic.co/u/heading)\ **Replies:** 2\ **Last updated:** [November 26, 2020, 2:18pm UTC](https://discuss.elastic.co/t/detection-rule-for-password-spraying-attempts/256628 "2020-11-26T14:18:43Z")
Hi, we have a use case where we want to detect if a host tries to log on to a certain number of different users. With threshold rules we are only able to detect a specific number of login attempts by a host. We cannot e… --- ## [Docker Elasticsearch Kibana Issues with Elastic-Agent sending data](https://discuss.elastic.co/t/docker-elasticsearch-kibana-issues-with-elastic-agent-sending-data/256581)
**Author:** [@cwobuzz](https://discuss.elastic.co/u/cwobuzz)\ **Replies:** 2\ **Last updated:** [November 25, 2020, 1:42pm UTC](https://discuss.elastic.co/t/docker-elasticsearch-kibana-issues-with-elastic-agent-sending-data/256581 "2020-11-25T13:42:56Z")
I want to use docker to host Elasticsearch and Kibana. I have that working with xpac. I will include my yml files below. I want to enable the elastic-agent on my host computer to ingest logs. This is just a small dev env… --- ## ["Run now" action for SIEM rule](https://discuss.elastic.co/t/run-now-action-for-siem-rule/256526)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [November 24, 2020, 4:03pm UTC](https://discuss.elastic.co/t/run-now-action-for-siem-rule/256526 "2020-11-24T16:03:43Z")
Hello, Not sure if there is already a way to do this or if this is already on some to do list, but imho it would be super nice if we could trigger a "Run Now" on a rule. Let me know if this seems an interesting addit… --- ## [Elastic-agent - Fail to enroll, Status code: 404](https://discuss.elastic.co/t/elastic-agent-fail-to-enroll-status-code-404/255772)
**Author:** [@ismyhairnice](https://discuss.elastic.co/u/ismyhairnice)\ **Replies:** 5\ **Last updated:** [November 24, 2020, 9:02am UTC](https://discuss.elastic.co/t/elastic-agent-fail-to-enroll-status-code-404/255772 "2020-11-24T09:02:08Z")
Hi all I was trying to enroll an elastic-agent by following the instructions that are shown in Kibana. elastic-agent enroll https://\:5601 ENROLLMENT\_KEY 2020-11-18T10:07:23.249+0800 DEBUG kibana/client… --- ## [Security /Hosts / User Authentifications empty](https://discuss.elastic.co/t/security-hosts-user-authentifications-empty/253720)
**Author:** [@BenjaminD](https://discuss.elastic.co/u/BenjaminD)\ **Replies:** 5\ **Last updated:** [November 22, 2020, 8:36am UTC](https://discuss.elastic.co/t/security-hosts-user-authentifications-empty/253720 "2020-11-22T08:36:50Z")
Hi, I installed Elasticsearch 7.9.3 a few days ago on a server and then Winlogbeat on 4 other servers. In the User Authentifications section, it displays 0 from the beginning, regardless of the chosen time frame. Wh… --- ## [Filebeat Office 365 Failed getting a token](https://discuss.elastic.co/t/filebeat-office-365-failed-getting-a-token/256264)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [November 23, 2020, 12:58am UTC](https://discuss.elastic.co/t/filebeat-office-365-failed-getting-a-token/256264 "2020-11-23T00:58:53Z")
Hello, Configured the Filebet o365 module. Everything worked fine for some time, but last night things stopped working. The last event sent was: When I restart Filebeat, things start working again. Anyone an idea wh… --- ## [Enrich SIEM Data](https://discuss.elastic.co/t/enrich-siem-data/255749)
**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Replies:** 1\ **Last updated:** [November 22, 2020, 8:10am UTC](https://discuss.elastic.co/t/enrich-siem-data/255749 "2020-11-22T08:10:55Z")
How to enrich SIEM data with Threat Intelligence? SIEM data can be overwhelming, how to implement Threat Intelligence feed like OTX Alienvault or other Intel feeds? --- ## [Adding a custom field in alerts without defining in query](https://discuss.elastic.co/t/adding-a-custom-field-in-alerts-without-defining-in-query/255300)
**Author:** [@PD98](https://discuss.elastic.co/u/PD98)\ **Replies:** 12\ **Last updated:** [November 20, 2020, 4:23am UTC](https://discuss.elastic.co/t/adding-a-custom-field-in-alerts-without-defining-in-query/255300 "2020-11-20T04:23:13Z")
Hi, I have a field called organization.name in my logs. I have created a rule based on the field externalId only. However I want that the organization.name field should also be fetched when the alert is generated. I don… --- ## [Eql query usage in watcher/siem detection rules](https://discuss.elastic.co/t/eql-query-usage-in-watcher-siem-detection-rules/255922)
**Author:** [@Akhil\_Mohan](https://discuss.elastic.co/u/Akhil_Mohan)\ **Replies:** 0\ **Last updated:** [November 19, 2020, 3:56am UTC](https://discuss.elastic.co/t/eql-query-usage-in-watcher-siem-detection-rules/255922 "2020-11-19T03:56:29Z")
EQL queries are available in elasticsearch 7.8 and later but we are not clear about how EQL queries are use in watcher/Siem detection rules.missing the documentation about same also. can you please instruct me how to us… --- ## [Extraction Elastic SIEM security events](https://discuss.elastic.co/t/extraction-elastic-siem-security-events/254927)
**Author:** [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\ **Replies:** 5\ **Last updated:** [November 18, 2020, 8:38pm UTC](https://discuss.elastic.co/t/extraction-elastic-siem-security-events/254927 "2020-11-18T20:38:02Z")
Hi There, Is there a possibility of extracting all the raw documents of elasticsearch with respect to SIEM events . For example if we have rule name : \[Unusual Login Activity\] and we have enabled this particular out o… --- ## [Windows 2019: elastic-agent and endpoint security](https://discuss.elastic.co/t/windows-2019-elastic-agent-and-endpoint-security/255679)
**Author:** [@fausap](https://discuss.elastic.co/u/fausap)\ **Replies:** 0\ **Last updated:** [November 17, 2020, 11:36am UTC](https://discuss.elastic.co/t/windows-2019-elastic-agent-and-endpoint-security/255679 "2020-11-17T11:36:53Z")
Hello, I'm testing the endpoint-security feature through Elastic Agent. I was able to install and enroll the agent, but I have this error in the logs: {"log.level":"error","@timestamp":"2020-11-17T12:19:09.127+0100","l… --- ## [Threat Intel and SIEM](https://discuss.elastic.co/t/threat-intel-and-siem/255404)
**Author:** [@randomguy](https://discuss.elastic.co/u/randomguy)\ **Replies:** 2\ **Last updated:** [November 17, 2020, 10:27am UTC](https://discuss.elastic.co/t/threat-intel-and-siem/255404 "2020-11-17T10:27:10Z")
Hi, I'm looking for a SIEM solution for our company. At the moment I'm trying to do it with ELK. My goal is: I would like to create fancy dashboards, alerts with events correlated from Threat Intel. I would like to u… --- ## [Endpoint 7.9 "Degraded and dashboards"](https://discuss.elastic.co/t/endpoint-7-9-degraded-and-dashboards/247452)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 28\ **Last updated:** [November 16, 2020, 8:50pm UTC](https://discuss.elastic.co/t/endpoint-7-9-degraded-and-dashboards/247452 "2020-11-16T20:50:26Z")
So first things first I know it's beta. But I've come into a few odd ball issues I haven't been able to stumble my way around. I have the Endpoint installed on a around 50 dev nodes now and I'm seeing a couple common ev… --- ## [SIEM Rule Use Case](https://discuss.elastic.co/t/siem-rule-use-case/255475)
**Author:** [@Ameer\_Mukadam](https://discuss.elastic.co/u/Ameer_Mukadam)\ **Replies:** 1\ **Last updated:** [November 16, 2020, 12:29pm UTC](https://discuss.elastic.co/t/siem-rule-use-case/255475 "2020-11-16T12:29:27Z")
Hi, I have a use case which I am not yet sure can be fulfilled by Elastic SIEM. I have created some different behavioral rules to detect ransomware activities and they work such as the deletion of restore of files and m… --- ## [Signal - multiple login failure from same user](https://discuss.elastic.co/t/signal-multiple-login-failure-from-same-user/255517)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 1\ **Last updated:** [November 16, 2020, 12:24pm UTC](https://discuss.elastic.co/t/signal-multiple-login-failure-from-same-user/255517 "2020-11-16T12:24:57Z")
Please help me to create a signal for below logic. Alert if there is more than 3 login failure from same user in last 5min. I have mentioned below the watcher query written for same above logic. “query”: { “bool”: { … --- ## [Compare two fields in SIEM](https://discuss.elastic.co/t/compare-two-fields-in-siem/253927)
**Author:** [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)\ **Replies:** 13\ **Last updated:** [November 16, 2020, 11:50am UTC](https://discuss.elastic.co/t/compare-two-fields-in-siem/253927 "2020-11-16T11:50:59Z")
Hi, I want to trigger an alarm if two fields have the same value. is it possible or I have to use watcher? [Previous page](https://discuss.elastic.co/c/security/83.md?page=53) [Next page](https://discuss.elastic.co/c/security/83.md?page=55)