# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=55 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 56 --- ## [Conditional query for SIEM](https://discuss.elastic.co/t/conditional-query-for-siem/255330)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 3\ **Last updated:** [November 16, 2020, 6:03am UTC](https://discuss.elastic.co/t/conditional-query-for-siem/255330 "2020-11-16T06:03:50Z")
Hi all I have some ability that i require SIEM do. i want to make a query and then if that query match then the second query will be call to search for that specific case since not all security case that happen in sing… --- ## [IP filtering without user authentication/authorization](https://discuss.elastic.co/t/ip-filtering-without-user-authentication-authorization/255455)
**Author:** [@ahmed\_hachena](https://discuss.elastic.co/u/ahmed_hachena)\ **Replies:** 1\ **Last updated:** [November 16, 2020, 12:44am UTC](https://discuss.elastic.co/t/ip-filtering-without-user-authentication-authorization/255455 "2020-11-16T00:44:12Z")
Hi when using IP filtering I'm having a security exception with my requests missing authentication credentials for REST request. is it possible to use IP filtering feature without user ? --- ## [Customize Detection Columns?](https://discuss.elastic.co/t/customize-detection-columns/254455)
**Author:** [@ikiril01](https://discuss.elastic.co/u/ikiril01)\ **Replies:** 10\ **Last updated:** [November 13, 2020, 9:14pm UTC](https://discuss.elastic.co/t/customize-detection-columns/254455 "2020-11-13T21:14:01Z")
Is it possible to customize the columns in the detections alerts view? I'd like to incorporate some fields from the underlying events, if possible. --- ## [Suricata logs](https://discuss.elastic.co/t/suricata-logs/254975)
**Author:** [@darrin.hodges](https://discuss.elastic.co/u/darrin.hodges)\ **Replies:** 1\ **Last updated:** [November 12, 2020, 1:23am UTC](https://discuss.elastic.co/t/suricata-logs/254975 "2020-11-12T01:23:03Z")
Hi all, I have a test setup with Kibana/Elasticsearch and elastic-agent. I'm wondering how to correctly ingest suricata logs so it provides useful information? thanks Darrin --- ## [API Key is getting generate when we are creating any Alerts using Webhook](https://discuss.elastic.co/t/api-key-is-getting-generate-when-we-are-creating-any-alerts-using-webhook/255085)
**Author:** [@shahidraza](https://discuss.elastic.co/u/shahidraza)\ **Replies:** 0\ **Last updated:** [November 11, 2020, 2:30pm UTC](https://discuss.elastic.co/t/api-key-is-getting-generate-when-we-are-creating-any-alerts-using-webhook/255085 "2020-11-11T14:30:36Z")
Hi Team, I have integrated Webhook to send alerts on Interlink and BigPanda. I am able to forward the alerts but whenever I am creating a new alert and passing payload body which contains one unique API key(API Keys fro… --- ## [Question on the capability of elastic SIEM](https://discuss.elastic.co/t/question-on-the-capability-of-elastic-siem/254843)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 1\ **Last updated:** [November 10, 2020, 7:10pm UTC](https://discuss.elastic.co/t/question-on-the-capability-of-elastic-siem/254843 "2020-11-10T19:10:02Z")
Hi all I have a question on how extent SIEM can query for data. Can siem query for regex data like the api can. --- ## [Ingesting from AWS & Azzure](https://discuss.elastic.co/t/ingesting-from-aws-azzure/254877)
**Author:** [@darkbeatz](https://discuss.elastic.co/u/darkbeatz)\ **Replies:** 1\ **Last updated:** [November 10, 2020, 4:40pm UTC](https://discuss.elastic.co/t/ingesting-from-aws-azzure/254877 "2020-11-10T16:40:22Z")
Hi All Just wondering if people are collecting logs from AWS or Azure and sending to elastic SIEM? Guard duty, cloudtrail etc.. How have you achieved this if so? --- ## [Building block rules/use case](https://discuss.elastic.co/t/building-block-rules-use-case/254737)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 7\ **Last updated:** [November 10, 2020, 9:13am UTC](https://discuss.elastic.co/t/building-block-rules-use-case/254737 "2020-11-10T09:13:40Z")
Hi, I am trying to understand the building block rules. Should we be able to create a rule that triggers if multiple building block rules trigger? If so how would I go about it? Thanks Phil --- ## [SIEM feature request](https://discuss.elastic.co/t/siem-feature-request/254504)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 3\ **Last updated:** [November 10, 2020, 2:51am UTC](https://discuss.elastic.co/t/siem-feature-request/254504 "2020-11-10T02:51:13Z")
Hi all, i have noticed that the api search in elastic using the console is really fast compare to how the kibana search. I was wondering if there is any difference in how kibana KQL search with the text box and the api … --- ## [SIEM rule not working for custom query](https://discuss.elastic.co/t/siem-rule-not-working-for-custom-query/253895)
**Author:** [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)\ **Replies:** 6\ **Last updated:** [November 9, 2020, 3:38pm UTC](https://discuss.elastic.co/t/siem-rule-not-working-for-custom-query/253895 "2020-11-09T15:38:49Z")
HI, I'm trying to create a simple rule that checks host.name field: But no signal is generating. here is my index mapping. I can see events in timeline using the same query. --- ## [SIEM Signals not triggering](https://discuss.elastic.co/t/siem-signals-not-triggering/254151)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 10\ **Last updated:** [November 9, 2020, 12:50pm UTC](https://discuss.elastic.co/t/siem-signals-not-triggering/254151 "2020-11-09T12:50:07Z")
SIEM signals are not triggering even after the events are generated. But same KQL query used in signal is working fine in discover tab. Please help me to resolve this issue. --- ## [Use case question: Support for reporting to third party](https://discuss.elastic.co/t/use-case-question-support-for-reporting-to-third-party/252681)
**Author:** [@Thremore](https://discuss.elastic.co/u/Thremore)\ **Replies:** 2\ **Last updated:** [November 9, 2020, 12:12pm UTC](https://discuss.elastic.co/t/use-case-question-support-for-reporting-to-third-party/252681 "2020-11-09T12:12:20Z")
Hello! Complete noob here. Thank you for your patience over my ignorance. I have a question regarding support for a the following use-case. TLDR: Given a completed security analysis of some event/events in a case or ti… --- ## [Custom SIEM rules: illegal\_argument\_exception permission issue](https://discuss.elastic.co/t/custom-siem-rules-illegal-argument-exception-permission-issue/253787)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 5\ **Last updated:** [November 6, 2020, 11:34pm UTC](https://discuss.elastic.co/t/custom-siem-rules-illegal-argument-exception-permission-issue/253787 "2020-11-06T23:34:27Z")
I've created a custom rule, which seems working if I run via the console. But when I put it as a SIEM rule, below error occurs Any idea which permission/privilege I need to do to fix the issue? An error occurred during… --- ## [How to modify overview tap in elastic security app](https://discuss.elastic.co/t/how-to-modify-overview-tap-in-elastic-security-app/254193)
**Author:** [@111387](https://discuss.elastic.co/u/111387)\ **Replies:** 3\ **Last updated:** [November 6, 2020, 6:14pm UTC](https://discuss.elastic.co/t/how-to-modify-overview-tap-in-elastic-security-app/254193 "2020-11-06T18:14:37Z")
I set some IPS logs into ECS format using Fluentd and then delivered them to elasticsearch. And you can see that the log is coming in from kibana. The problem is that Elastic Security's Overview tap doesn't show the nu… --- ## [SIEM rule override not working as expected](https://discuss.elastic.co/t/siem-rule-override-not-working-as-expected/253933)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 6\ **Last updated:** [November 4, 2020, 12:55pm UTC](https://discuss.elastic.co/t/siem-rule-override-not-working-as-expected/253933 "2020-11-04T12:55:22Z")
Hello, Recently tried to use the severity overrides functionality for a SIEM rule, but this doesn't seem to work as expected. While trying to find what's going wrong I'd like to point out several things: When editing… --- ## [Security overview doesn't show any data](https://discuss.elastic.co/t/security-overview-doesnt-show-any-data/246099)
**Author:** [@s\_elk](https://discuss.elastic.co/u/s_elk)\ **Replies:** 5\ **Last updated:** [November 4, 2020, 12:54am UTC](https://discuss.elastic.co/t/security-overview-doesnt-show-any-data/246099 "2020-11-04T00:54:24Z")
Hi, I've installed the new version 7.9. I've 4 hosts (Linux/Windows) online in my Fleet tab under Ingest Manager (I've installed elastic agent correctly on them) with some active integrations (Elastic Endpoint Security… --- ## [Elastic Agent (Fleet Deployment) behind a proxy](https://discuss.elastic.co/t/elastic-agent-fleet-deployment-behind-a-proxy/254183)
**Author:** [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Replies:** 6\ **Last updated:** [November 4, 2020, 7:42am UTC](https://discuss.elastic.co/t/elastic-agent-fleet-deployment-behind-a-proxy/254183 "2020-11-04T07:42:02Z")
Hi, I'm testing the generic elastic agent with the endpoint security integration. I had some problems because I'm using a custom CA, but luckily the tips in https://github.com/elastic/kibana/issues/73483 helped me and … --- ## [End Point 7.9.2 no datasets or data](https://discuss.elastic.co/t/end-point-7-9-2-no-datasets-or-data/252889)
**Author:** [@frankfoti](https://discuss.elastic.co/u/frankfoti)\ **Replies:** 3\ **Last updated:** [November 3, 2020, 11:51pm UTC](https://discuss.elastic.co/t/end-point-7-9-2-no-datasets-or-data/252889 "2020-11-03T23:51:23Z")
I followed configuring ingest manager with fleet mode https://www.elastic.co/guide/en/ingest-management/7.9/ingest-management-getting-started.html. Added End Point Security, Systems and Windows to the default configurat… --- ## [Cant sent mail upon SIEM alert](https://discuss.elastic.co/t/cant-sent-mail-upon-siem-alert/253517)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 2\ **Last updated:** [November 3, 2020, 1:31am UTC](https://discuss.elastic.co/t/cant-sent-mail-upon-siem-alert/253517 "2020-11-03T01:31:18Z")
Hi all I have some problems with the alert and action with siem part i have config the alert and action to exacly like our watcher ( watcher worked ) I have turned on the xpack.eventLog.logEntries to true when i set … --- ## [Pre-built set of rules still using SYSMON based detection (winlogbeat- \*, event.code: 1, etc.) or using linguistic terms specific to an operating system (eg: Win 10 EN system user is SYSTEM, but Win 10 PT-BR system user is SISTEMA)](https://discuss.elastic.co/t/pre-built-set-of-rules-still-using-sysmon-based-detection-winlogbeat-event-code-1-etc-or-using-linguistic-terms-specific-to-an-operating-system-eg-win-10-en-system-user-is-system-but-win-10-pt-br-system-user-is-sistema/252933)
**Author:** [@skysbsb](https://discuss.elastic.co/u/skysbsb)\ **Replies:** 1\ **Last updated:** [November 3, 2020, 12:42am UTC](https://discuss.elastic.co/t/pre-built-set-of-rules-still-using-sysmon-based-detection-winlogbeat-event-code-1-etc-or-using-linguistic-terms-specific-to-an-operating-system-eg-win-10-en-system-user-is-system-but-win-10-pt-br-system-user-is-sistema/252933 "2020-11-03T00:42:25Z")
Pre-built set of rules still using SYSMON-based detection (winlogbeat- \*, event.code: 1, etc.) or using linguistic terms specific to an operating system (eg Win 10 EN system user is SYSTEM, but Win 10 PT-BR system user i… --- ## [Watcher Alert on Agg Field & Painless Script Condition Error](https://discuss.elastic.co/t/watcher-alert-on-agg-field-painless-script-condition-error/253060)
**Author:** [@jc034240](https://discuss.elastic.co/u/jc034240)\ **Replies:** 1\ **Last updated:** [November 3, 2020, 12:02am UTC](https://discuss.elastic.co/t/watcher-alert-on-agg-field-painless-script-condition-error/253060 "2020-11-03T00:02:37Z")
Hello everyone, My goal of the Watcher is to fire when the unique count of hosts, from the hostname field drops below 110. I have tried both .value and .doc\_count in the script portion of the condition but still get th… --- ## [Elastic Agent not sending Data](https://discuss.elastic.co/t/elastic-agent-not-sending-data/245728)
**Author:** [@Ameer\_Mukadam](https://discuss.elastic.co/u/Ameer_Mukadam)\ **Replies:** 18\ **Last updated:** [November 2, 2020, 8:00pm UTC](https://discuss.elastic.co/t/elastic-agent-not-sending-data/245728 "2020-11-02T20:00:44Z")
So I upgraded my stack to 7.9 last night to try out elastic security, but thing is I am able to enroll the agent usings fleets update the configurations and all but my agent is not able to send any data to elasticsearch,… --- ## [What are the essential ecs items in elastic siem?](https://discuss.elastic.co/t/what-are-the-essential-ecs-items-in-elastic-siem/253509)
**Author:** [@111387](https://discuss.elastic.co/u/111387)\ **Replies:** 10\ **Last updated:** [November 1, 2020, 4:52am UTC](https://discuss.elastic.co/t/what-are-the-essential-ecs-items-in-elastic-siem/253509 "2020-11-01T04:52:22Z")
I collected syslogs of security devices (WAF, IPS, IDS (suricata), anti-DDoS) by filebeat, delivered to logstash, and stacked them in elastisearch. I know that using filebeat, it automatically makes it into ecs format, … --- ## [Detections with custom query](https://discuss.elastic.co/t/detections-with-custom-query/252628)
**Author:** [@Anirudhan](https://discuss.elastic.co/u/Anirudhan)\ **Replies:** 14\ **Last updated:** [October 30, 2020, 4:40pm UTC](https://discuss.elastic.co/t/detections-with-custom-query/252628 "2020-10-30T16:40:38Z")
Hi In the detections, rules created a custom rule for my own index. A simple match query is not working, but the same rule is working with an aggregate query.! detections|690x283 The rule with custom query externalId:… --- ## [Security -\> Administration Page not getting past Enrollment](https://discuss.elastic.co/t/security-administration-page-not-getting-past-enrollment/246125)
**Author:** [@nicpenning](https://discuss.elastic.co/u/nicpenning)\ **Replies:** 3\ **Last updated:** [October 30, 2020, 11:19am UTC](https://discuss.elastic.co/t/security-administration-page-not-getting-past-enrollment/246125 "2020-10-30T11:19:36Z")
Hello, We have been testing the new Elastic Agent and Endpoint security functionality introduced in 7.9.0. We have an agent already enrolled by the Administration page keeps prompting use to enroll the agent. We can va… --- ## [Fleet enrolement okay, but checkin fails](https://discuss.elastic.co/t/fleet-enrolement-okay-but-checkin-fails/253372)
**Author:** [@finbarr996](https://discuss.elastic.co/u/finbarr996)\ **Replies:** 1\ **Last updated:** [October 30, 2020, 11:12am UTC](https://discuss.elastic.co/t/fleet-enrolement-okay-but-checkin-fails/253372 "2020-10-30T11:12:43Z")
Hi there, I have ES 7.9.3 running on an Ubuntu server, xpack security is enabled and working using self generated certs on the ES node. Fleet agent enrolement for a windows 10 host initially failed with an "x509: certi… --- ## [TLS Information](https://discuss.elastic.co/t/tls-information/253794)
**Author:** [@Mauricio\_Borges](https://discuss.elastic.co/u/Mauricio_Borges)\ **Replies:** 3\ **Last updated:** [October 30, 2020, 11:10am UTC](https://discuss.elastic.co/t/tls-information/253794 "2020-10-30T11:10:11Z")
Hi Team! What are the integration tools ( beats family etc ) required to we collect certificates data from session connections to identify TLS Version, Ciphers, Valid until, Issuer, Subject, fingerprint etc from a host … --- ## [Elastic Endpoint Security - Testing detections - Whoami rule](https://discuss.elastic.co/t/elastic-endpoint-security-testing-detections-whoami-rule/253622)
**Author:** [@StephItUp](https://discuss.elastic.co/u/StephItUp)\ **Replies:** 2\ **Last updated:** [October 29, 2020, 5:20pm UTC](https://discuss.elastic.co/t/elastic-endpoint-security-testing-detections-whoami-rule/253622 "2020-10-29T17:20:31Z")
Hi Folks, I have installed elasticagent and enrolled my device via ingest manager. I have 3 integrations within my configuration: System Windows Elastic Endpoint Security I imported the Elastic Detection ru… --- ## [Error getting details for process](https://discuss.elastic.co/t/error-getting-details-for-process/253061)
**Author:** [@gnordli](https://discuss.elastic.co/u/gnordli)\ **Replies:** 3\ **Last updated:** [October 27, 2020, 10:14pm UTC](https://discuss.elastic.co/t/error-getting-details-for-process/253061 "2020-10-27T22:14:34Z")
I am seeing quite a few log entries like this. The Endpoint agent is running as the local system account. { "@timestamp": "2020-10-22T17:46:14.800Z", "message": "Error getting details for process services.exe with … --- ## [Index patterns global and per rule?](https://discuss.elastic.co/t/index-patterns-global-and-per-rule/253109)
**Author:** [@widhalmt](https://discuss.elastic.co/u/widhalmt)\ **Replies:** 2\ **Last updated:** [October 27, 2020, 12:44pm UTC](https://discuss.elastic.co/t/index-patterns-global-and-per-rule/253109 "2020-10-27T12:44:59Z")
Hi, I know, that I have to set in Stack Management/Kibana/Advanced which Indices are considered when SIEM is doing it's magic. But I just recently realised there are another "index patterns" per rule. Are these mere re… [Previous page](https://discuss.elastic.co/c/security/83.md?page=54) [Next page](https://discuss.elastic.co/c/security/83.md?page=56)