# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=56 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 57 --- ## [Detection Rule Error](https://discuss.elastic.co/t/detection-rule-error/252856)
**Author:** [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Replies:** 5\ **Last updated:** [October 27, 2020, 5:04am UTC](https://discuss.elastic.co/t/detection-rule-error/252856 "2020-10-27T05:04:26Z")
Hi, I'm running the 7.9.2 version of the stack in a hot-warm cluster architecture. When defining a very simple detection rule on my space called "siem" I get the following error intermittently. One execution succeed an… --- ## [SIEM Threshold Based Rules - Show several fields value](https://discuss.elastic.co/t/siem-threshold-based-rules-show-several-fields-value/253385)
**Author:** [@Kambing](https://discuss.elastic.co/u/Kambing)\ **Replies:** 0\ **Last updated:** [October 27, 2020, 4:41am UTC](https://discuss.elastic.co/t/siem-threshold-based-rules-show-several-fields-value/253385 "2020-10-27T04:41:16Z")
Hi, I already create threshold based detection and it was successfully detected. But I realize it only has specific fields to display and is different from Query based detection which contain all fields when the rules tr… --- ## [RDP from Internet rule triggering on bogon ip address](https://discuss.elastic.co/t/rdp-from-internet-rule-triggering-on-bogon-ip-address/253269)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 2\ **Last updated:** [October 26, 2020, 10:53am UTC](https://discuss.elastic.co/t/rdp-from-internet-rule-triggering-on-bogon-ip-address/253269 "2020-10-26T10:53:32Z")
Hello, Noticed the SIEM rule" RDP (Remote Desktop Protocol) from the Internet" triggered on source.ip: "169.254.231.41" which is a bogon link-local address. So this should not be considered as "from the Internet" and… --- ## [Mutual tls/ssl on elasticsearch](https://discuss.elastic.co/t/mutual-tls-ssl-on-elasticsearch/252502)
**Author:** [@Daniel\_Schneider](https://discuss.elastic.co/u/Daniel_Schneider)\ **Replies:** 26\ **Last updated:** [October 21, 2020, 10:15am UTC](https://discuss.elastic.co/t/mutual-tls-ssl-on-elasticsearch/252502 "2020-10-21T10:15:13Z")
Hi I have problem that reminds me topic https://discuss.elastic.co/t/mutual-tls-ssl-on-elasticsearch/197768 I'm trying to set mutual tls/ssl authentication between ES server and CURL client. TLS communication works, ES… --- ## [Shards failed in Network screen](https://discuss.elastic.co/t/shards-failed-in-network-screen/252774)
**Author:** [@gnordli](https://discuss.elastic.co/u/gnordli)\ **Replies:** 6\ **Last updated:** [October 22, 2020, 6:54pm UTC](https://discuss.elastic.co/t/shards-failed-in-network-screen/252774 "2020-10-22T18:54:57Z")
I am using the Elastic Endpoint agents with 7.9.2. Elasticsearch is running in a single node cluster I am getting an error when in the network screen saying 5 of 7 shards have failed. curl -u elastic -X GET "127.0.0.1… --- ## [Detections is adding 20-30 minutes to my @timestamp](https://discuss.elastic.co/t/detections-is-adding-20-30-minutes-to-my-timestamp/252401)
**Author:** [@Junebee](https://discuss.elastic.co/u/Junebee)\ **Replies:** 2\ **Last updated:** [October 22, 2020, 12:53pm UTC](https://discuss.elastic.co/t/detections-is-adding-20-30-minutes-to-my-timestamp/252401 "2020-10-22T12:53:01Z")
I am a long time user of ELK and recently switched to 7.9 to experiment with Security and SIEM functions. After much trouble shooting to get my test Detection to show up in the "Detection Alerts" area, I discovered by … --- ## [Elastic siem overview dashboard config](https://discuss.elastic.co/t/elastic-siem-overview-dashboard-config/252916)
**Author:** [@111387](https://discuss.elastic.co/u/111387)\ **Replies:** 1\ **Last updated:** [October 22, 2020, 1:20am UTC](https://discuss.elastic.co/t/elastic-siem-overview-dashboard-config/252916 "2020-10-22T01:20:34Z")
Hello. I recevied suricata and other security solution logs with filebeat and send to Elastic Siem Is it possible to edit the list in the Network Event, Host Event menu in SIEM's Overview Tab?? I don't use Auditbeat a… --- ## [Cannot filter data in elastic SIEM](https://discuss.elastic.co/t/cannot-filter-data-in-elastic-siem/252124)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 5\ **Last updated:** [October 20, 2020, 10:47pm UTC](https://discuss.elastic.co/t/cannot-filter-data-in-elastic-siem/252124 "2020-10-20T22:47:29Z")
Hi all I have a problems in the elastic siem. The filter function for me when i tried to filter for some field in the rule that i have created. those field seems to be not recognized by elastic so they do not allow me … --- ## [SIEM error unexpected token \ **Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 5\ **Last updated:** [October 20, 2020, 10:44pm UTC](https://discuss.elastic.co/t/siem-error-unexpected-token-in-json-at-position-0/252327 "2020-10-20T22:44:59Z") Hi all I currently have a very anoying problems Everytime i went to SIEM app, they load for sometime and then the system popup a error unexpected token \ **Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 4\ **Last updated:** [October 20, 2020, 3:38pm UTC](https://discuss.elastic.co/t/adding-screenshots-to-cases/251556 "2020-10-20T15:38:17Z") Hello, An awesome enhancement to SIEM would be the ability to paste screenshots in the created cases. Although the timeline is a handy thing, a quick screenshot makes things a lot more clear. Is this a feature that woul… --- ## [Avast triggering false positives](https://discuss.elastic.co/t/avast-triggering-false-positives/252584)
**Author:** [@0xDECAFBAD](https://discuss.elastic.co/u/0xDECAFBAD)\ **Replies:** 1\ **Last updated:** [October 20, 2020, 3:26pm UTC](https://discuss.elastic.co/t/avast-triggering-false-positives/252584 "2020-10-20T15:26:34Z")
I'm testing Elastic Endpoint on a handful of machines and one thing I noticed is that Avast Antivirus seems to trigger false positive file creation alerts. It sounds like this is the directory Avast will extract files in… --- ## [Elastic Community and Ecosystem - Elastic Training](https://discuss.elastic.co/t/elastic-community-and-ecosystem-elastic-training/252459)
**Author:** [@imaneg](https://discuss.elastic.co/u/imaneg)\ **Replies:** 4\ **Last updated:** [October 18, 2020, 8:18pm UTC](https://discuss.elastic.co/t/elastic-community-and-ecosystem-elastic-training/252459 "2020-10-18T20:18:52Z")
Hi All, I am preparing for the exam and I am wondering about the answer of this question: Secure a cluster using Elasticsearch Security Would the configurations proposed in this tutorial be sufficient? Or need I to c… --- ## [EQL to query DSL: how to Convert EQL to SQL or DSL?](https://discuss.elastic.co/t/eql-to-query-dsl-how-to-convert-eql-to-sql-or-dsl/252415)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 0\ **Last updated:** [October 17, 2020, 10:05am UTC](https://discuss.elastic.co/t/eql-to-query-dsl-how-to-convert-eql-to-sql-or-dsl/252415 "2020-10-17T10:05:15Z")
hi in similar lines of question "KQL to DSL" any libraries/options to convert EQL used for siem into Elastic query DSL? Looking for something like the SQL Translate api equivalent for EQL --- ## [EQL: Why basic query is different from dataset](https://discuss.elastic.co/t/eql-why-basic-query-is-different-from-dataset/252242)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 5\ **Last updated:** [October 15, 2020, 9:14pm UTC](https://discuss.elastic.co/t/eql-why-basic-query-is-different-from-dataset/252242 "2020-10-15T21:14:45Z")
I'm running a simple EQL query to test as follows, but NOT reporting anything back GET winlogbeat\*/\_eql/search { "query": """ process where process.name == "services.exe" """ } Quite lot of data is present and If… --- ## [Elastic endpoint Could not communicate with Checking API will retry](https://discuss.elastic.co/t/elastic-endpoint-could-not-communicate-with-checking-api-will-retry/251303)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 4\ **Last updated:** [October 15, 2020, 7:04am UTC](https://discuss.elastic.co/t/elastic-endpoint-could-not-communicate-with-checking-api-will-retry/251303 "2020-10-15T07:04:06Z")
Hello everybody, I am trying elastic endpoint from code source and I am getting this error: Could not communicate with Checking API will retry, error: fail to checkin to fleet: Post "https://@IP\_KIBANA:5601/api/ingest\_… --- ## [Elastic SIEM](https://discuss.elastic.co/t/elastic-siem/251784)
**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Replies:** 5\ **Last updated:** [October 14, 2020, 9:04pm UTC](https://discuss.elastic.co/t/elastic-siem/251784 "2020-10-14T21:04:24Z")
I am having issues starting the ML datafeeds for SIEM, I've tried manually putting in a mapping for @timestamp as date but i still get this error anyone else have this issue ? \` "{"error":{"root\_cause":\[{"type":"status… --- ## [Failed to load SSL configuration on windows server](https://discuss.elastic.co/t/failed-to-load-ssl-configuration-on-windows-server/251852)
**Author:** [@dorcas](https://discuss.elastic.co/u/dorcas)\ **Replies:** 2\ **Last updated:** [October 13, 2020, 7:10am UTC](https://discuss.elastic.co/t/failed-to-load-ssl-configuration-on-windows-server/251852 "2020-10-13T07:10:29Z")
hello am getting this error on a windows server kindly help failed to load SSL configuration \[xpack.security.http.ssl\] am using version elasticsearch-7.6.1 and i installed the .p12 on the server and i can see this on mm… --- ## [Elastic Endpoint Security with Elastic Agent](https://discuss.elastic.co/t/elastic-endpoint-security-with-elastic-agent/249804)
**Author:** [@jsu](https://discuss.elastic.co/u/jsu)\ **Replies:** 15\ **Last updated:** [October 8, 2020, 11:49am UTC](https://discuss.elastic.co/t/elastic-endpoint-security-with-elastic-agent/249804 "2020-10-08T11:49:54Z")
Hey, I installed the Elastic agent on a linux endpoints (ubuntu) to test how it works and the difference between managing this versus managing regular beats. Everything worked great. Then, I wanted to test the Elastic … --- ## [Elastic 7.9.1 - Security (SIEM) - Your visualization has error(s) - \[illegal\_argument\_exception\]](https://discuss.elastic.co/t/elastic-7-9-1-security-siem-your-visualization-has-error-s-illegal-argument-exception/250265)
**Author:** [@Derick\_Jansen](https://discuss.elastic.co/u/Derick_Jansen)\ **Replies:** 15\ **Last updated:** [October 12, 2020, 8:05pm UTC](https://discuss.elastic.co/t/elastic-7-9-1-security-siem-your-visualization-has-error-s-illegal-argument-exception/250265 "2020-10-12T20:05:40Z")
Hi, We have a brand new cluster install to test 7.9.1 and the security features in particular. When navigating to the Overview page we get the following error. \[illegal\_argument\_exception\] Text fields are not optimise… --- ## [How to make Elastic Endpoint not stoppable unless with a password](https://discuss.elastic.co/t/how-to-make-elastic-endpoint-not-stoppable-unless-with-a-password/251561)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 5\ **Last updated:** [October 12, 2020, 2:57pm UTC](https://discuss.elastic.co/t/how-to-make-elastic-endpoint-not-stoppable-unless-with-a-password/251561 "2020-10-12T14:57:24Z")
Hello, I am testing elastic endpoint and it's working perfectly, I just wanna know if there is a solution to make the endpoint not stoppable unless if we enter a password to make it more secure. Best regards --- ## [Going from detection page to rule page in 1 click](https://discuss.elastic.co/t/going-from-detection-page-to-rule-page-in-1-click/251636)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 2\ **Last updated:** [October 12, 2020, 4:10pm UTC](https://discuss.elastic.co/t/going-from-detection-page-to-rule-page-in-1-click/251636 "2020-10-12T16:10:10Z")
Hello, Just an idea (which might already be on some roadmap). It would save us a lot of time if we could go from the Detections page straight to the rule page. This could be done for example by adding a button to: Cu… --- ## [1 alert for all detections & suppress repeat detections](https://discuss.elastic.co/t/1-alert-for-all-detections-suppress-repeat-detections/251550)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 3\ **Last updated:** [October 12, 2020, 2:10pm UTC](https://discuss.elastic.co/t/1-alert-for-all-detections-suppress-repeat-detections/251550 "2020-10-12T14:10:19Z")
Hi, I am now on 7.9.2, is there the ability to create an alert for all detections or does it involve going through each indivudually? Also i remember there was talk of been able to suppress detections so that noisy dete… --- ## [Threshold rules not triggering on selfmade index](https://discuss.elastic.co/t/threshold-rules-not-triggering-on-selfmade-index/251029)
**Author:** [@madduck](https://discuss.elastic.co/u/madduck)\ **Replies:** 15\ **Last updated:** [October 9, 2020, 12:49pm UTC](https://discuss.elastic.co/t/threshold-rules-not-triggering-on-selfmade-index/251029 "2020-10-09T12:49:13Z")
Hello, I am currently trying to create a simple threshold rule that should trigger after x amounts of failed logons. The issue here is that the rule does not trigger at all, not even when the threshold is set to 1. Th… --- ## [Spammy Logs](https://discuss.elastic.co/t/spammy-logs/251046)
**Author:** [@animageofmine](https://discuss.elastic.co/u/animageofmine)\ **Replies:** 2\ **Last updated:** [October 8, 2020, 8:08am UTC](https://discuss.elastic.co/t/spammy-logs/251046 "2020-10-08T08:08:43Z")
We enabled security on Elastic recently (6.8). We see a crazy amount of logs with the following stacktrace even though all the requests we observe are using the right credentials. It has filed the docker logs by about 22… --- ## [Elastic Endpoint Security missing host](https://discuss.elastic.co/t/elastic-endpoint-security-missing-host/250420)
**Author:** [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Replies:** 20\ **Last updated:** [October 7, 2020, 9:32pm UTC](https://discuss.elastic.co/t/elastic-endpoint-security-missing-host/250420 "2020-10-07T21:32:39Z")
Hi, I am running ELK v7.9.2 standalone I just started to test Elastic Endpoint Security (from now on "EES"). I managed to enable all the necessary settings on the ELK host side and deployed EES in two different hosts: … --- ## [Threshold Rule for Detecting Brute force Attacks](https://discuss.elastic.co/t/threshold-rule-for-detecting-brute-force-attacks/245866)
**Author:** [@Ameer\_Mukadam](https://discuss.elastic.co/u/Ameer_Mukadam)\ **Replies:** 6\ **Last updated:** [October 7, 2020, 9:20pm UTC](https://discuss.elastic.co/t/threshold-rule-for-detecting-brute-force-attacks/245866 "2020-10-07T21:20:48Z")
Hi, with the release of 7.9 I tried creating a threshold rule for detecting and alerting Windows Brute Force Attacks. The query is Event.code 4625 and the threshold field is host.name greater than equal to 5. But the ru… --- ## [Case Connectors](https://discuss.elastic.co/t/case-connectors/250733)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 3\ **Last updated:** [October 7, 2020, 12:10pm UTC](https://discuss.elastic.co/t/case-connectors/250733 "2020-10-07T12:10:00Z")
Hello, Really like the Kibana case functionality. Unfortunately we aren't working with any of the supported case connector tools. Out ITSM tool is Ivanti Heat, which is not a small player in the ITSM market, see: I… --- ## [Suricata Redis\>ELK Stack Mapping help please](https://discuss.elastic.co/t/suricata-redis-elk-stack-mapping-help-please/250860)
**Author:** [@bn1980](https://discuss.elastic.co/u/bn1980)\ **Replies:** 1\ **Last updated:** [October 6, 2020, 12:26am UTC](https://discuss.elastic.co/t/suricata-redis-elk-stack-mapping-help-please/250860 "2020-10-06T00:26:34Z")
I am running Suricata on PFSense and my goal is to create a Network Security Monitoring Dashboard with world map. Likely in Grafana. I use FreeNAS with ELK setup in a FreeBSD jail. My elasticsearch is 7.7.1 and did not… --- ## [SIEM feature request](https://discuss.elastic.co/t/siem-feature-request/250340)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 4\ **Last updated:** [October 1, 2020, 11:22pm UTC](https://discuss.elastic.co/t/siem-feature-request/250340 "2020-10-01T23:22:36Z")
Hi, As i was scrolling down the huge pile of log and then i come up with this ideal for SIEM that i really want What i want is the ability to detect multiple event subsequently, what i mean is that for example i have a… --- ## [Calling Alerts from Watchers to detection Signals](https://discuss.elastic.co/t/calling-alerts-from-watchers-to-detection-signals/250032)
**Author:** [@Suro](https://discuss.elastic.co/u/Suro)\ **Replies:** 14\ **Last updated:** [October 1, 2020, 8:36am UTC](https://discuss.elastic.co/t/calling-alerts-from-watchers-to-detection-signals/250032 "2020-10-01T08:36:40Z")
Hi, We are running multiple watchers and as the SIEM detection does not provide the level of customizations, I have been unable to create use cases which takes aggregation for example under consideration. So I want to c… [Previous page](https://discuss.elastic.co/c/security/83.md?page=55) [Next page](https://discuss.elastic.co/c/security/83.md?page=57)