# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=57 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 58 --- ## [How install endpoint-security--7.9.1 package on Linux？](https://discuss.elastic.co/t/how-install-endpoint-security-7-9-1-package-on-linux/249465)
**Author:** [@windkill](https://discuss.elastic.co/u/windkill)\ **Replies:** 3\ **Last updated:** [September 30, 2020, 9:20pm UTC](https://discuss.elastic.co/t/how-install-endpoint-security-7-9-1-package-on-linux/249465 "2020-09-30T21:20:13Z")
hi~ guys，Can anyone tell me how to download endpoint-security--7.9.1 package manually？And put it to where？ For Window client I know download it with url “https://artifacts.elastic.co/downloads/endpoint-dev/endpoint-s… --- ## [Question on populating SIEM dashboard with winlogbeat data and Logstash](https://discuss.elastic.co/t/question-on-populating-siem-dashboard-with-winlogbeat-data-and-logstash/250510)
**Author:** [@Johan-p](https://discuss.elastic.co/u/Johan-p)\ **Replies:** 1\ **Last updated:** [September 30, 2020, 4:14pm UTC](https://discuss.elastic.co/t/question-on-populating-siem-dashboard-with-winlogbeat-data-and-logstash/250510 "2020-09-30T16:14:35Z")
Hi everyone, My company is setting up a Proof of Concept with Elastic SIEM. Running an on-prem setup: 3 Elastic nodes in a cluster configuration with one Kibana server and one Logstash server. While testing the SIEM d… --- ## [Run detection rule manually](https://discuss.elastic.co/t/run-detection-rule-manually/249780)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 1\ **Last updated:** [September 29, 2020, 8:23pm UTC](https://discuss.elastic.co/t/run-detection-rule-manually/249780 "2020-09-29T20:23:07Z")
Hi all How to run the detection rule manually, I have some rule that have query time of about few hour each, and i want to have a quick test of the rule to make quick change. Is there some curl or something to do that… --- ## [Elastic Agent for Mobile Android and iOS](https://discuss.elastic.co/t/elastic-agent-for-mobile-android-and-ios/250399)
**Author:** [@kal1s](https://discuss.elastic.co/u/kal1s)\ **Replies:** 1\ **Last updated:** [September 29, 2020, 6:29pm UTC](https://discuss.elastic.co/t/elastic-agent-for-mobile-android-and-ios/250399 "2020-09-29T18:29:33Z")
Hi, We're using the Elastic Agent with Metricbeat , Filebeat , and Endpoint Security for Linux , macOS , and Windows and it's working nicely ! For Monitoring , Data Analysis , Alerts , and Machine Learn… --- ## [Packetbeat Rare DNS Questions ML Job Customization](https://discuss.elastic.co/t/packetbeat-rare-dns-questions-ml-job-customization/247548)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 6\ **Last updated:** [September 29, 2020, 10:31am UTC](https://discuss.elastic.co/t/packetbeat-rare-dns-questions-ml-job-customization/247548 "2020-09-29T10:31:11Z")
Hello, I have an issue with the packetbeat rare dns question ml job, which generates quite a bit of anomalies due to the fact that our hosts are frequently contacting \*.avqs.mcafee.com url's, which have a random part. F… --- ## [\[IMPROVEMENT REQUEST\] Add risk score field to each rule in Endgame](https://discuss.elastic.co/t/improvement-request-add-risk-score-field-to-each-rule-in-endgame/250125)
**Author:** [@kdawg](https://discuss.elastic.co/u/kdawg)\ **Replies:** 1\ **Last updated:** [September 28, 2020, 7:06pm UTC](https://discuss.elastic.co/t/improvement-request-add-risk-score-field-to-each-rule-in-endgame/250125 "2020-09-28T19:06:18Z")
Feature request Describe the feature: Add a field to Endgame rules to include a risk score to show when the rule is triggered, this will assist with prioritizing these alerts. Description of the problem: When many di… --- ## [How to test malware protection?](https://discuss.elastic.co/t/how-to-test-malware-protection/249850)
**Author:** [@0xDECAFBAD](https://discuss.elastic.co/u/0xDECAFBAD)\ **Replies:** 2\ **Last updated:** [September 28, 2020, 2:20am UTC](https://discuss.elastic.co/t/how-to-test-malware-protection/249850 "2020-09-28T02:20:01Z")
From what I read it sounds like Endgame malware protection is definition-less? Is that correct? Is it based solely on behavioral analysis? I'm testing out Elastic Security, just pushed my first Elastic Endpoint deploymen… --- ## [SIEM detection rule apply for difference time](https://discuss.elastic.co/t/siem-detection-rule-apply-for-difference-time/249750)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 1\ **Last updated:** [September 25, 2020, 2:15pm UTC](https://discuss.elastic.co/t/siem-detection-rule-apply-for-difference-time/249750 "2020-09-25T14:15:39Z")
Hi all I have a question regarding the SIEM detection, i have some windows log that are from 2019, and now when index them in to our elastic the @timestamp for it is 2019, now i want the detection engine to also search… --- ## [Elastic SIEM "Data Fetch Failure Invalid time value"](https://discuss.elastic.co/t/elastic-siem-data-fetch-failure-invalid-time-value/249388)
**Author:** [@soufiane\_adn](https://discuss.elastic.co/u/soufiane_adn)\ **Replies:** 5\ **Last updated:** [September 25, 2020, 2:07pm UTC](https://discuss.elastic.co/t/elastic-siem-data-fetch-failure-invalid-time-value/249388 "2020-09-25T14:07:54Z")
Hello guys, i hope you are doing well, so i'm facing a problem on the elastic siem app after parsing my logs and migrating them to ecs by logstash. the problem is the following error on the host/ event view : Data F… --- ## [Add winlogbeat Info to Email Action](https://discuss.elastic.co/t/add-winlogbeat-info-to-email-action/249523)
**Author:** [@Nyhmesis](https://discuss.elastic.co/u/Nyhmesis)\ **Replies:** 1\ **Last updated:** [September 25, 2020, 2:06pm UTC](https://discuss.elastic.co/t/add-winlogbeat-info-to-email-action/249523 "2020-09-25T14:06:42Z")
Hello all! I'm very new to the Elastic stack so I'll try to not sound completely dumb. Under Security -\> Detections, I have modified the existing detection rule that detects when the process whoami.exe is ran and added… --- ## [Endpoint 7.9.x Process/Folder exemptions with ingest manager?](https://discuss.elastic.co/t/endpoint-7-9-x-process-folder-exemptions-with-ingest-manager/248866)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 10\ **Last updated:** [September 22, 2020, 4:33pm UTC](https://discuss.elastic.co/t/endpoint-7-9-x-process-folder-exemptions-with-ingest-manager/248866 "2020-09-22T16:33:51Z")
This may seem like a really simple question... For some reason the obvious answers are escaping me at the moment. For Endpoint how do you set an exemption for a folder and process? This is not for an entire fleet of mac… --- ## [Winlogbeat 7.9 not shipping logs in full ECS?](https://discuss.elastic.co/t/winlogbeat-7-9-not-shipping-logs-in-full-ecs/249411)
**Author:** [@AleksandrN](https://discuss.elastic.co/u/AleksandrN)\ **Replies:** 3\ **Last updated:** [September 24, 2020, 11:28am UTC](https://discuss.elastic.co/t/winlogbeat-7-9-not-shipping-logs-in-full-ecs/249411 "2020-09-24T11:28:56Z")
Hello everyone, I'mtrying to fill my Elastic SIEM with data, but it seems like Winlogbeat is not shipping logs in full ECS. For example, authentications wiget is empty: And it is formed by such default request: { … --- ## [Config alerts and actions email connector](https://discuss.elastic.co/t/config-alerts-and-actions-email-connector/249501)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 7\ **Last updated:** [September 24, 2020, 10:05am UTC](https://discuss.elastic.co/t/config-alerts-and-actions-email-connector/249501 "2020-09-24T10:05:35Z")
Hi all I wanted to try to config the mail sending feature for the SIEM, when i config the connector for email 2 encounter 2 problems: the username and password part every time i try to add new to it, when i save it t… --- ## [Elastic SIEM showing duplicate hosts when Defender ATP logs are shipped in](https://discuss.elastic.co/t/elastic-siem-showing-duplicate-hosts-when-defender-atp-logs-are-shipped-in/249152)
**Author:** [@InnerJoin](https://discuss.elastic.co/u/InnerJoin)\ **Replies:** 5\ **Last updated:** [September 23, 2020, 2:44pm UTC](https://discuss.elastic.co/t/elastic-siem-showing-duplicate-hosts-when-defender-atp-logs-are-shipped-in/249152 "2020-09-23T14:44:54Z")
I am currently working on getting together a POC of the Elastic SIEM solution. I already have a machine shipping logs into Elasticsearch with a winlogbeat agent and I am showing in the Hosts section of the SIEM that logs… --- ## [SIEM, Auditbeat Queries](https://discuss.elastic.co/t/siem-auditbeat-queries/249571)
**Author:** [@ckough](https://discuss.elastic.co/u/ckough)\ **Replies:** 0\ **Last updated:** [September 22, 2020, 5:42pm UTC](https://discuss.elastic.co/t/siem-auditbeat-queries/249571 "2020-09-22T17:42:16Z")
Hi there, I am trying out Elastic Siem 7.7 with Auditbeat 7.7 on Red Hat 7.6 and I have a few questions. Is SIEM data available only when I set Auditbeat output to elasticsearch? I try output to logstash-\>elasticsearc… --- ## [Elastic siem receive another Security Device log](https://discuss.elastic.co/t/elastic-siem-receive-another-security-device-log/249318)
**Author:** [@111387](https://discuss.elastic.co/u/111387)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 3:24pm UTC](https://discuss.elastic.co/t/elastic-siem-receive-another-security-device-log/249318 "2020-09-21T15:24:28Z")
I Want to Using IPS, Anti Virus etc.. log in Elastic Siem is it possible using this log??? i want security log to logstash -\> ElasticSiem and make Correlation rules --- ## [Endpoint Security integration is sending its data always to default namespace](https://discuss.elastic.co/t/endpoint-security-integration-is-sending-its-data-always-to-default-namespace/249109)
**Author:** [@SanWieb](https://discuss.elastic.co/u/SanWieb)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 2:13pm UTC](https://discuss.elastic.co/t/endpoint-security-integration-is-sending-its-data-always-to-default-namespace/249109 "2020-09-21T14:13:50Z")
Hi all, If you make a new configuration with as namespace not default but let's say 'custom'. All integrations which you add will have default as namespace 'custom', also the Elastic Endpoint Security. However, the Ela… --- ## [Filebeat not picking up OSQUERY LOGS](https://discuss.elastic.co/t/filebeat-not-picking-up-osquery-logs/249279)
**Author:** [@Vansh\_Kumar\_Madan](https://discuss.elastic.co/u/Vansh_Kumar_Madan)\ **Replies:** 0\ **Last updated:** [September 20, 2020, 7:21pm UTC](https://discuss.elastic.co/t/filebeat-not-picking-up-osquery-logs/249279 "2020-09-20T19:21:34Z")
Hi, I am trying to intergate filbeat osquey module, my osquery is running successfully, and logs are building up at path /var/log/osquery/osqueryd.results.log I am passing this path in filebeat osquery module osquery.… --- ## [SIEM detection engine is not getting started](https://discuss.elastic.co/t/siem-detection-engine-is-not-getting-started/248910)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 12\ **Last updated:** [September 20, 2020, 12:52pm UTC](https://discuss.elastic.co/t/siem-detection-engine-is-not-getting-started/248910 "2020-09-20T12:52:04Z")
I have installed stack on AWS, all three(Elastic, Logstash, Kibana) components are on different instance. Stack is running all good and functioning in a expected way. Problem is, I am unable to enable detection engine, … --- ## [Is ES security features are free? specially xpack file based authentication](https://discuss.elastic.co/t/is-es-security-features-are-free-specially-xpack-file-based-authentication/248972)
**Author:** [@arsalan\_siddiqui](https://discuss.elastic.co/u/arsalan_siddiqui)\ **Replies:** 1\ **Last updated:** [September 19, 2020, 1:37pm UTC](https://discuss.elastic.co/t/is-es-security-features-are-free-specially-xpack-file-based-authentication/248972 "2020-09-19T13:37:33Z")
I am native user of elastic search, can someone please help in understanding that is xpack.security.enabled:true with file base authentication is free or have a license cost. --- ## [SIEM Hosts/All Hosts Tables Empty](https://discuss.elastic.co/t/siem-hosts-all-hosts-tables-empty/248965)
**Author:** [@Dan\_Sputnikk](https://discuss.elastic.co/u/Dan_Sputnikk)\ **Replies:** 2\ **Last updated:** [September 19, 2020, 4:07am UTC](https://discuss.elastic.co/t/siem-hosts-all-hosts-tables-empty/248965 "2020-09-19T04:07:00Z")
Hi all, Configured filebeat 7.9 against ES/Kibana 7.9 and the netflow + cisco modules successfully and without errors, including during template generation. http s://www.elastic.co/guide/en/beats/filebeat/7.9/filebeat-… --- ## [(ELK 7.9.1) Security - Hosts and Security - Network missing data](https://discuss.elastic.co/t/elk-7-9-1-security-hosts-and-security-network-missing-data/248576)
**Author:** [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Replies:** 19\ **Last updated:** [September 17, 2020, 10:19pm UTC](https://discuss.elastic.co/t/elk-7-9-1-security-hosts-and-security-network-missing-data/248576 "2020-09-17T22:19:57Z")
Hi, \*Recently upgraded to ELK 7.9.1. \*All beats were upgraded to match same node version \*All indexes were deleted and recreated As stated above, I am running ELK 7.9.1. If I check Discovery section, I can confirm th… --- ## [Limit CPU/Memory usage in Auditbeat & Filebeats , version 7.9.0](https://discuss.elastic.co/t/limit-cpu-memory-usage-in-auditbeat-filebeats-version-7-9-0/248231)
**Author:** [@ajesh](https://discuss.elastic.co/u/ajesh)\ **Replies:** 7\ **Last updated:** [September 17, 2020, 1:23pm UTC](https://discuss.elastic.co/t/limit-cpu-memory-usage-in-auditbeat-filebeats-version-7-9-0/248231 "2020-09-17T13:23:10Z")
Hi Team, We are seeing that auditbeat service is using lot of memory in our VM's , we suspect that when elasticsearch cluster is down its taking more memory in auditbeat to buffer the data. Could you please let me know … --- ## [Does Endpoint Security replace Winlogbeat?](https://discuss.elastic.co/t/does-endpoint-security-replace-winlogbeat/247574)
**Author:** [@OntheHighSeas](https://discuss.elastic.co/u/OntheHighSeas)\ **Replies:** 8\ **Last updated:** [September 17, 2020, 8:10am UTC](https://discuss.elastic.co/t/does-endpoint-security-replace-winlogbeat/247574 "2020-09-17T08:10:37Z")
Hi, At the risk of asking something completely stupid, does the Endpoint Security Agent replace Winlogbeats? I've been shipping workstation / server MS event logs including Sysmon via Winlogbeats for a while now, and I… --- ## [Error activating rule…](https://discuss.elastic.co/t/error-activating-rule/248424)
**Author:** [@Akash\_Upadhyay](https://discuss.elastic.co/u/Akash_Upadhyay)\ **Replies:** 8\ **Last updated:** [September 15, 2020, 10:11pm UTC](https://discuss.elastic.co/t/error-activating-rule/248424 "2020-09-15T22:11:49Z")
Hey, I have installed elk using docker. It is up and running fine. But the problem occurs when I try to activate pre-built rules. My docker-compose.yml configurations are: version: '3' services: elasticsearch: … --- ## [Install Elastic Security Endpoint](https://discuss.elastic.co/t/install-elastic-security-endpoint/247942)
**Author:** [@syafeera](https://discuss.elastic.co/u/syafeera)\ **Replies:** 3\ **Last updated:** [September 15, 2020, 7:50am UTC](https://discuss.elastic.co/t/install-elastic-security-endpoint/247942 "2020-09-15T07:50:33Z")
Hi , Is there anyone here know how to install Elastic Security Endpoint agent in MAC OS? I have follow the instruction but the agent not appear at data set...Thanks --- ## [Parsing o365.audit.Data filed for o365 Module](https://discuss.elastic.co/t/parsing-o365-audit-data-filed-for-o365-module/248370)
**Author:** [@opiedrah](https://discuss.elastic.co/u/opiedrah)\ **Replies:** 2\ **Last updated:** [September 14, 2020, 6:21pm UTC](https://discuss.elastic.co/t/parsing-o365-audit-data-filed-for-o365-module/248370 "2020-09-14T18:21:00Z")
Hi folks, I've had the o365 module for Filebeat working for a while. I've onboarded a new workload called: o365.audit.Workload :"AirInvestigation" The filed is composed of nested json objects just the same as the Ext… --- ## [How can receive log in elastic siem using logstash](https://discuss.elastic.co/t/how-can-receive-log-in-elastic-siem-using-logstash/248258)
**Author:** [@111387](https://discuss.elastic.co/u/111387)\ **Replies:** 1\ **Last updated:** [September 11, 2020, 9:14pm UTC](https://discuss.elastic.co/t/how-can-receive-log-in-elastic-siem-using-logstash/248258 "2020-09-11T21:14:13Z")
I installed suricata, and i want using elastic siem so. i installed filebeat and send to elastic search and kibana i well. but i want to using logstash. i try that filebeat send log to logstash and logstash pass to el… --- ## [Failed to load plugin class \[org.elasticsearch.xpack.core.XPackPlugin](https://discuss.elastic.co/t/failed-to-load-plugin-class-org-elasticsearch-xpack-core-xpackplugin/248169)
**Author:** [@JB06](https://discuss.elastic.co/u/JB06)\ **Replies:** 1\ **Last updated:** [September 10, 2020, 4:44pm UTC](https://discuss.elastic.co/t/failed-to-load-plugin-class-org-elasticsearch-xpack-core-xpackplugin/248169 "2020-09-10T16:44:13Z")
Hello, Version "7.8.0" I use this command /usr/share/elasticsearch/bin/elasticsearch-certutil cert ca --pem --silent -in /var/tmp/instance.yml --out /var/tmp/certs.zip --pass $PASSWORD I copy result in /etc/elasticse… --- ## [Missing Elastic Security and endpoint integration data](https://discuss.elastic.co/t/missing-elastic-security-and-endpoint-integration-data/246601)
**Author:** [@OntheHighSeas](https://discuss.elastic.co/u/OntheHighSeas)\ **Replies:** 15\ **Last updated:** [September 9, 2020, 4:16pm UTC](https://discuss.elastic.co/t/missing-elastic-security-and-endpoint-integration-data/246601 "2020-09-09T16:16:58Z")
Hi Team. Great work with the continued developments of Elastic, love the product. So I've upgraded to v7.9 and eager to test out the new Elastic Agent/Endpoint etc. I've enrolled a test agent insecurely, i.e. -i and t… [Previous page](https://discuss.elastic.co/c/security/83.md?page=56) [Next page](https://discuss.elastic.co/c/security/83.md?page=58)