# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=58 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 59 --- ## [Unable to load ASA logs in SIEM](https://discuss.elastic.co/t/unable-to-load-asa-logs-in-siem/247977)
**Author:** [@Kupauw](https://discuss.elastic.co/u/Kupauw)\ **Replies:** 1\ **Last updated:** [September 9, 2020, 9:22am UTC](https://discuss.elastic.co/t/unable-to-load-asa-logs-in-siem/247977 "2020-09-09T09:22:24Z")
Hi everyone. Last week i set up a filebeat (7.8.1) to ingest syslog from an Cisco ASA. Everything works fine and the data is visible in kibana. Now when i go to the SIEM page and try to setup SIEM with the Cisco module… --- ## [Siem Rule to detect ssh login with multiple source address](https://discuss.elastic.co/t/siem-rule-to-detect-ssh-login-with-multiple-source-address/247718)
**Author:** [@Kambing](https://discuss.elastic.co/u/Kambing)\ **Replies:** 2\ **Last updated:** [September 9, 2020, 8:23am UTC](https://discuss.elastic.co/t/siem-rule-to-detect-ssh-login-with-multiple-source-address/247718 "2020-09-09T08:23:04Z")
Hi, I'm new with Elastic SIEM and now I need to create a rule to detect ssh successful login with multiple IP address with the same username. I wonder how can I create a rule like this since if I using Custon Query or Th… --- ## [Threat Hunting Report for Elasticsearch](https://discuss.elastic.co/t/threat-hunting-report-for-elasticsearch/246540)
**Author:** [@syafeera](https://discuss.elastic.co/u/syafeera)\ **Replies:** 10\ **Last updated:** [September 9, 2020, 1:25am UTC](https://discuss.elastic.co/t/threat-hunting-report-for-elasticsearch/246540 "2020-09-09T01:25:13Z")
Hi there, Did anyone here know how to do Threat Hunting report using SIEM in Kibana? --- ## [Detection Rules, Signals and CCS](https://discuss.elastic.co/t/detection-rules-signals-and-ccs/247818)
**Author:** [@Rob3](https://discuss.elastic.co/u/Rob3)\ **Replies:** 2\ **Last updated:** [September 8, 2020, 3:50pm UTC](https://discuss.elastic.co/t/detection-rules-signals-and-ccs/247818 "2020-09-08T15:50:44Z")
As far as I can tell, the SIEM app, in particular the builtin detection rules do not support cross cluster search? Is there any way to configure a CCS cluster/kibana instance such that the CCS kibana instance runs the d… --- ## [AMSI support](https://discuss.elastic.co/t/amsi-support/247695)
**Author:** [@WayneJLee](https://discuss.elastic.co/u/WayneJLee)\ **Replies:** 1\ **Last updated:** [September 8, 2020, 1:09pm UTC](https://discuss.elastic.co/t/amsi-support/247695 "2020-09-08T13:09:06Z")
Hi everyone First post here and just wanna say I love what Elastic has done with the SIEM app and now endpoints. However, I've been running some tests and it doesn't seem like the Elastic Endpoint Security Agent curren… --- ## [Authentications tab shows "All values returned zero"](https://discuss.elastic.co/t/authentications-tab-shows-all-values-returned-zero/240784)
**Author:** [@xhidalgo](https://discuss.elastic.co/u/xhidalgo)\ **Replies:** 14\ **Last updated:** [September 8, 2020, 6:22am UTC](https://discuss.elastic.co/t/authentications-tab-shows-all-values-returned-zero/240784 "2020-09-08T06:22:22Z")
Hi, I'm using Elastic Cloud, I have two different deployments. One in version 7.6.2 and Elastic SIEM it's working properly and one in 7.8.0 In this last version 7.8.0 , SIEM Module don't show authentications even when… --- ## [Journalbeat in Elastic SIEM](https://discuss.elastic.co/t/journalbeat-in-elastic-siem/247305)
**Author:** [@Alfredo1](https://discuss.elastic.co/u/Alfredo1)\ **Replies:** 1\ **Last updated:** [September 3, 2020, 12:17pm UTC](https://discuss.elastic.co/t/journalbeat-in-elastic-siem/247305 "2020-09-03T12:17:02Z")
I recently started consuming HashiCorp Vault (secrets manager) audit logs into my cluster via Journalbeat, and while it's great to view the logs in Discover, it would be useful to surface those logs and associated metric… --- ## [Feature Request: Alert Assignment to user](https://discuss.elastic.co/t/feature-request-alert-assignment-to-user/247095)
**Author:** [@madduck](https://discuss.elastic.co/u/madduck)\ **Replies:** 1\ **Last updated:** [September 2, 2020, 5:49pm UTC](https://discuss.elastic.co/t/feature-request-alert-assignment-to-user/247095 "2020-09-02T17:49:45Z")
Hello, playing around more and more with the SIEM and signals etc. and I saw that there does not seem to be a way to assign signals. I can mark them as "open", "in progress" or "done" however I have no information whic… --- ## [Elastic Agent with Private Certificate Still not working](https://discuss.elastic.co/t/elastic-agent-with-private-certificate-still-not-working/246515)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 4\ **Last updated:** [September 2, 2020, 4:57pm UTC](https://discuss.elastic.co/t/elastic-agent-with-private-certificate-still-not-working/246515 "2020-09-02T16:57:28Z")
Hello there, I´m now using a private certificate (GoDaddy) and even so, I cannot make it to work. Bellow I got my ELK stack using the private certificate: Bellow I got the first step towards the enrolling: Bellow… --- ## [Elastic endpoint overwrites configuration file](https://discuss.elastic.co/t/elastic-endpoint-overwrites-configuration-file/246531)
**Author:** [@Zawadidone](https://discuss.elastic.co/u/Zawadidone)\ **Replies:** 16\ **Last updated:** [September 2, 2020, 2:19pm UTC](https://discuss.elastic.co/t/elastic-endpoint-overwrites-configuration-file/246531 "2020-09-02T14:19:13Z")
Everytime when I start elastic-endpoint.exe it overwrites the file elastic-endpoint.yaml with: hosts: - http://localhost:9200 Because of that the Elastic agent is not sending any data to my Elasticsearch cluster th… --- ## [Feedback: Cases](https://discuss.elastic.co/t/feedback-cases/247101)
**Author:** [@madduck](https://discuss.elastic.co/u/madduck)\ **Replies:** 1\ **Last updated:** [September 2, 2020, 12:59pm UTC](https://discuss.elastic.co/t/feedback-cases/247101 "2020-09-02T12:59:59Z")
Hello, its me again, took a look at Cases, saw they are still in Beta, thought I'd share some feedback. No option to lock a case At the moment it is not possible to lock a case from other users. This can be helpful if… --- ## [Syslog events from Watchguard firewall not appearing](https://discuss.elastic.co/t/syslog-events-from-watchguard-firewall-not-appearing/247097)
**Author:** [@finbarr996](https://discuss.elastic.co/u/finbarr996)\ **Replies:** 2\ **Last updated:** [September 1, 2020, 6:50pm UTC](https://discuss.elastic.co/t/syslog-events-from-watchguard-firewall-not-appearing/247097 "2020-09-01T18:50:58Z")
Hi there, I have upgraded to 7.9 across the board and syslog events aren't showing up in security as they previously did in SEIM. I am bringing these in via Logstash with a config file that reformats them, and I can se… --- ## [SIEM Threshold - unique values](https://discuss.elastic.co/t/siem-threshold-unique-values/246606)
**Author:** [@PhilA](https://discuss.elastic.co/u/PhilA)\ **Replies:** 5\ **Last updated:** [September 1, 2020, 3:18pm UTC](https://discuss.elastic.co/t/siem-threshold-unique-values/246606 "2020-09-01T15:18:33Z")
Hi I am playing with the SIEM capability and have been using it since it was released with custom queries. I am now looking at Threshold based detection in v7.9 - something I think will be very useful. I'm not sure if… --- ## [Uninstall/Install Elastic-Endpoint. Endpoint stays after uninstall](https://discuss.elastic.co/t/uninstall-install-elastic-endpoint-endpoint-stays-after-uninstall/247014)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 1\ **Last updated:** [September 1, 2020, 2:10pm UTC](https://discuss.elastic.co/t/uninstall-install-elastic-endpoint-endpoint-stays-after-uninstall/247014 "2020-09-01T14:10:54Z")
To not high jack an existing thread about another subject see " https://discuss.elastic.co/t/elastic-endpoint-overwrites-configuration-file/246531/6 " Uninstall goes like this. Open power shell as admin. Run uninstall-s… --- ## [No TLS details](https://discuss.elastic.co/t/no-tls-details/222593)
**Author:** [@NogNeetMachinaal](https://discuss.elastic.co/u/NogNeetMachinaal)\ **Replies:** 2\ **Last updated:** [August 31, 2020, 8:54pm UTC](https://discuss.elastic.co/t/no-tls-details/222593 "2020-08-31T20:54:11Z")
See also attached image: While there seem to be thousands of TLS handshakes, the SIEM-network table with TLS details is empty. The Packetbeat config details: - type: tls # Configure the ports where to listen for T… --- ## [External Alerts not showing up](https://discuss.elastic.co/t/external-alerts-not-showing-up/246155)
**Author:** [@Ameer\_Mukadam](https://discuss.elastic.co/u/Ameer_Mukadam)\ **Replies:** 3\ **Last updated:** [August 31, 2020, 3:59pm UTC](https://discuss.elastic.co/t/external-alerts-not-showing-up/246155 "2020-08-31T15:59:19Z")
So with 7.9 elastic brought support for Sophos FW I quickly updated everything and started shipping logs using filebeat and everything seems to be working fine except 1 thing which is events from alert.kind: alert are ge… --- ## [Add rule exception with prefilled data](https://discuss.elastic.co/t/add-rule-exception-with-prefilled-data/246100)
**Author:** [@zerlett](https://discuss.elastic.co/u/zerlett)\ **Replies:** 3\ **Last updated:** [August 31, 2020, 11:17am UTC](https://discuss.elastic.co/t/add-rule-exception-with-prefilled-data/246100 "2020-08-31T11:17:04Z")
We like the new feature to add rule exceptions. In our opinion it would be very helpful to prefill the value fields with known data of Signals when you click the three dots ("Add rule exception"). For example prefill t… --- ## [Value list entries as a trigger instead of exception](https://discuss.elastic.co/t/value-list-entries-as-a-trigger-instead-of-exception/246747)
**Author:** [@madduck](https://discuss.elastic.co/u/madduck)\ **Replies:** 2\ **Last updated:** [August 28, 2020, 6:35pm UTC](https://discuss.elastic.co/t/value-list-entries-as-a-trigger-instead-of-exception/246747 "2020-08-28T18:35:39Z")
Hi gang, is it possible to use value list as anything other than an exception? I have a list of Command and Control servers and would like to get a signal every time an ip address from that value list is part of "desti… --- ## [Mac - workflow configuration failure (driver missing)](https://discuss.elastic.co/t/mac-workflow-configuration-failure-driver-missing/246484)
**Author:** [@thatsatechnique](https://discuss.elastic.co/u/thatsatechnique)\ **Replies:** 2\ **Last updated:** [August 27, 2020, 11:47pm UTC](https://discuss.elastic.co/t/mac-workflow-configuration-failure-driver-missing/246484 "2020-08-27T23:47:53Z")
Trying out the new 7.9 endpoint security agent...everything installed, enrolled, and runs fine. I am, however, seeing "failed" under each configuration response section (see screenshot). They all fail on Workflow. Dig… --- ## [Detection engine permission issues after upgrade to 7.9](https://discuss.elastic.co/t/detection-engine-permission-issues-after-upgrade-to-7-9/246407)
**Author:** [@j91321](https://discuss.elastic.co/u/j91321)\ **Replies:** 2\ **Last updated:** [August 26, 2020, 10:41am UTC](https://discuss.elastic.co/t/detection-engine-permission-issues-after-upgrade-to-7-9/246407 "2020-08-26T10:41:57Z")
Hi, Yesterday we have upgraded our cluster to 7.9 and users are reporting problems with the Detection tab in SIEM app. When opened they get "Let's set up your detection engine" message. The role assigned to the users h… --- ## [Unsynchronized time in Elasticsearch](https://discuss.elastic.co/t/unsynchronized-time-in-elasticsearch/246083)
**Author:** [@bornatalebi](https://discuss.elastic.co/u/bornatalebi)\ **Replies:** 2\ **Last updated:** [August 26, 2020, 8:28am UTC](https://discuss.elastic.co/t/unsynchronized-time-in-elasticsearch/246083 "2020-08-26T08:28:20Z")
Hi Today when I created a rule in SIEM the "last run" field showed "in 3 hours". after some digging, I found that the clock in the ELK machine(single node cluster, centos 7) was behind. I correct it using ntp and now wh… --- ## [Endpoint config on elastic](https://discuss.elastic.co/t/endpoint-config-on-elastic/245878)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 4\ **Last updated:** [August 25, 2020, 5:29pm UTC](https://discuss.elastic.co/t/endpoint-config-on-elastic/245878 "2020-08-25T17:29:54Z")
Hi all, After elastic annoucing that the endpoint will have free plan i immediately try it and i have some issue. After i i config tls so that i can use the fleet option, then every time i try to go in to the administr… --- ## [Can not get network sockets info](https://discuss.elastic.co/t/can-not-get-network-sockets-info/245398)
**Author:** [@ali.al-janabi](https://discuss.elastic.co/u/ali.al-janabi)\ **Replies:** 7\ **Last updated:** [August 25, 2020, 3:57pm UTC](https://discuss.elastic.co/t/can-not-get-network-sockets-info/245398 "2020-08-25T15:57:55Z")
Hello, I'm deploying elasticsearch SIEM using auditbeat and having trouble to get the network sockets counts, open, closed information. they all show 0 value in the network socket dashboard. in my deployment, I have el… --- ## [ELK SIEM](https://discuss.elastic.co/t/elk-siem/246234)
**Author:** [@Deepika\_Rawat](https://discuss.elastic.co/u/Deepika_Rawat)\ **Replies:** 3\ **Last updated:** [August 25, 2020, 12:49pm UTC](https://discuss.elastic.co/t/elk-siem/246234 "2020-08-25T12:49:21Z")
Is Elk SIEM free ?? and how can i import data in siem through logstash i just wanted to check its functionality as a threat analyst.I am looking and comparing more options but since i am familiar with logstash and filebe… --- ## [Azure Filebeat User Authentications](https://discuss.elastic.co/t/azure-filebeat-user-authentications/246271)
**Author:** [@josborn](https://discuss.elastic.co/u/josborn)\ **Replies:** 0\ **Last updated:** [August 25, 2020, 11:26am UTC](https://discuss.elastic.co/t/azure-filebeat-user-authentications/246271 "2020-08-25T11:26:12Z")
Hi All, First time posting so go easy on me. I am on the latest version 7.9 and have been configuring the Azure filebeat module to ingest signin events. The events are populating and all fields are present and correct,… --- ## [Sophos module not working](https://discuss.elastic.co/t/sophos-module-not-working/245629)
**Author:** [@Ameer\_Mukadam](https://discuss.elastic.co/u/Ameer_Mukadam)\ **Replies:** 3\ **Last updated:** [August 24, 2020, 8:13am UTC](https://discuss.elastic.co/t/sophos-module-not-working/245629 "2020-08-24T08:13:23Z")
So I have been waiting for the Sophos XG module for some time since we use Sophos XG FW and when I got to know that 7.9 was released I quickly updated my filebeat and tried setting up the ingest pipeline for sophos but t… --- ## [Threshold rule to alert when logs stop coming in from a log source](https://discuss.elastic.co/t/threshold-rule-to-alert-when-logs-stop-coming-in-from-a-log-source/246007)
**Author:** [@Ameer\_Mukadam](https://discuss.elastic.co/u/Ameer_Mukadam)\ **Replies:** 1\ **Last updated:** [August 23, 2020, 11:00pm UTC](https://discuss.elastic.co/t/threshold-rule-to-alert-when-logs-stop-coming-in-from-a-log-source/246007 "2020-08-23T23:00:09Z")
Hi, I read on the elastic blog that we can use threshold rules to detect if a log source has stopped sending in logs to es but I am still not sure how to create such a rule can anyone help me. --- ## [Signal detection ML rule not working](https://discuss.elastic.co/t/signal-detection-ml-rule-not-working/245984)
**Author:** [@SUNILKUMAR\_BATANA](https://discuss.elastic.co/u/SUNILKUMAR_BATANA)\ **Replies:** 0\ **Last updated:** [August 22, 2020, 12:01pm UTC](https://discuss.elastic.co/t/signal-detection-ml-rule-not-working/245984 "2020-08-22T12:01:15Z")
Hi, I tried to create a ML rule for detecting signals when there is an anomaly in a ML job. The ML job is clearly showing anomalies but the rule is not detecting signals. Further, the rule is getting executed successf… --- ## [Security settings for Elastic SIEM on-prem](https://discuss.elastic.co/t/security-settings-for-elastic-siem-on-prem/245738)
**Author:** [@john7](https://discuss.elastic.co/u/john7)\ **Replies:** 1\ **Last updated:** [August 20, 2020, 12:08pm UTC](https://discuss.elastic.co/t/security-settings-for-elastic-siem-on-prem/245738 "2020-08-20T12:08:14Z")
Hi everyone, I'm working on setting up a small Elastic Cluster as a proof of concept for a SIEM. Consisting of 3 elastic nodes, one kibana node and one logstash node. I managed to get a working cluster without the sec… --- ## [Auditbeat compared to Winlogbeat, Metricbeat](https://discuss.elastic.co/t/auditbeat-compared-to-winlogbeat-metricbeat/244779)
**Author:** [@fgjensen](https://discuss.elastic.co/u/fgjensen)\ **Replies:** 4\ **Last updated:** [August 19, 2020, 7:50pm UTC](https://discuss.elastic.co/t/auditbeat-compared-to-winlogbeat-metricbeat/244779 "2020-08-19T19:50:23Z")
On Windows Auditbeat the system module exposes the host and processes datasets. In this setup the file integrity module is not used. On the same MS servers Winlogbeat with the security module as well as Metricbeat and Pa… [Previous page](https://discuss.elastic.co/c/security/83.md?page=57) [Next page](https://discuss.elastic.co/c/security/83.md?page=59)