# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=6 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 7 --- ## [Elastic Agent changes local security policy?](https://discuss.elastic.co/t/elastic-agent-changes-local-security-policy/377601)
**Author:** [@ben-sec](https://discuss.elastic.co/u/ben-sec)\ **Replies:** 2\ **Last updated:** [April 29, 2025, 9:25am UTC](https://discuss.elastic.co/t/elastic-agent-changes-local-security-policy/377601 "2025-04-29T09:25:42Z")
Hi! I wanted to point an existing Windows Elastic Agent to a new Elasticsearch instance and used the following commands: .\\elastic-agent unprivileged -f --user="user name" --password="PW" .\\elastic-agent.exe enroll -f… --- ## [Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score triggering on all kinds of normal processes](https://discuss.elastic.co/t/machine-learning-detected-a-suspicious-windows-event-with-a-high-malicious-probability-score-triggering-on-all-kinds-of-normal-processes/377523)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 0\ **Last updated:** [April 25, 2025, 2:38pm UTC](https://discuss.elastic.co/t/machine-learning-detected-a-suspicious-windows-event-with-a-high-malicious-probability-score-triggering-on-all-kinds-of-normal-processes/377523 "2025-04-25T14:38:17Z")
Hello, I activated "Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score" and "Living off the Land Attack Detection" and followed the procedure. It seems to be triggering on a l… --- ## [Firewall logs to different Datastream by type](https://discuss.elastic.co/t/firewall-logs-to-different-datastream-by-type/377211)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 22\ **Last updated:** [April 24, 2025, 12:57pm UTC](https://discuss.elastic.co/t/firewall-logs-to-different-datastream-by-type/377211 "2025-04-24T12:57:39Z")
I am using the integration “Fortinet FortiGate Firewall Logs”. To date it is working correctly, but I have been asked to ingest the UTM type logs in a different Datastream and I really have no idea how to do this using … --- ## [Security Case Management Based on Parent Tenant & Subsidiary](https://discuss.elastic.co/t/security-case-management-based-on-parent-tenant-subsidiary/377471)
**Author:** [@kulisiber](https://discuss.elastic.co/u/kulisiber)\ **Replies:** 0\ **Last updated:** [April 24, 2025, 2:37am UTC](https://discuss.elastic.co/t/security-case-management-based-on-parent-tenant-subsidiary/377471 "2025-04-24T02:37:08Z")
Hi everyone, I have a case like the following, I monitor the parent company as well as the subsidiary. I've created 2 different tenants. What if I want to display all the cases that are made specifically from the "Secur… --- ## [Are the Self Signed Certs bound by IP / Hostname](https://discuss.elastic.co/t/are-the-self-signed-certs-bound-by-ip-hostname/377147)
**Author:** [@Umang\_Pachaury](https://discuss.elastic.co/u/Umang_Pachaury)\ **Replies:** 11\ **Last updated:** [April 21, 2025, 11:23pm UTC](https://discuss.elastic.co/t/are-the-self-signed-certs-bound-by-ip-hostname/377147 "2025-04-21T23:23:17Z")
Hi, We have a cluster in which we have enabled TLS security. To enable the security we used the elastic cert utility to generate the cert and CA. While generation of the certs or the CA any of the prompts did not ask us… --- ## [Prebuilt Rule Customization is an Enterprise feature?!](https://discuss.elastic.co/t/prebuilt-rule-customization-is-an-enterprise-feature/377312)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 0\ **Last updated:** [April 19, 2025, 4:14pm UTC](https://discuss.elastic.co/t/prebuilt-rule-customization-is-an-enterprise-feature/377312 "2025-04-19T16:14:46Z")
Hey, I was excited to read about prebuilt rule customization, which would alleviate my pain of duplicating prebuilt rules just to add some minute detail. However, I was shocked to see this not just not in the free vers… --- ## [False positive report](https://discuss.elastic.co/t/false-positive-report/377259)
**Author:** [@teclink](https://discuss.elastic.co/u/teclink)\ **Replies:** 1\ **Last updated:** [April 17, 2025, 2:52pm UTC](https://discuss.elastic.co/t/false-positive-report/377259 "2025-04-17T14:52:34Z")
Dear Elastic There is a false positive for our company's software. our company's product IP-guard was mistakenly killed by Elastic .Hope to add our product to the whitelist，thank you 0a8fd6142caccbec3785bec6a316c7f6 3… --- ## [CEF integration gives error if it encounters non-UTF-8 valuestion](https://discuss.elastic.co/t/cef-integration-gives-error-if-it-encounters-non-utf-8-valuestion/377193)
**Author:** [@Cristina\_Marletta\_Li](https://discuss.elastic.co/u/Cristina_Marletta_Li)\ **Replies:** 0\ **Last updated:** [April 16, 2025, 12:41pm UTC](https://discuss.elastic.co/t/cef-integration-gives-error-if-it-encounters-non-utf-8-valuestion/377193 "2025-04-16T12:41:02Z")
Hi, CEF integration gives error if it encounters non-UTF-8 values. What alternatives do I have? Change the integration type? How can I at least prevent the error.message field from being populated when there are non-UTF… --- ## [Domain Generation Algorithm Detection Documentation Page: Images Missing](https://discuss.elastic.co/t/domain-generation-algorithm-detection-documentation-page-images-missing/376988)
**Author:** [@warren.cruz](https://discuss.elastic.co/u/warren.cruz)\ **Replies:** 1\ **Last updated:** [April 16, 2025, 3:03am UTC](https://discuss.elastic.co/t/domain-generation-algorithm-detection-documentation-page-images-missing/376988 "2025-04-16T03:03:43Z")
Good day, Just like to raise the issue of missing images in the following documentation page: Domain Generation Algorithm Detection | Elastic integrations | Elastic Thanks. Regards, Warren --- ## [Changes removed from system index templates](https://discuss.elastic.co/t/changes-removed-from-system-index-templates/377168)
**Author:** [@jcruz](https://discuss.elastic.co/u/jcruz)\ **Replies:** 0\ **Last updated:** [April 15, 2025, 10:56pm UTC](https://discuss.elastic.co/t/changes-removed-from-system-index-templates/377168 "2025-04-15T22:56:16Z")
I have made some changes to a system index template (.alerts-security.alerts-default-index-template) by adding a new Component Template to map some custom fields for use as filters in the Alerts dashboard. However, after… --- ## [Roles permissions/privileges](https://discuss.elastic.co/t/roles-permissions-privileges/376984)
**Author:** [@jsng](https://discuss.elastic.co/u/jsng)\ **Replies:** 1\ **Last updated:** [April 14, 2025, 8:43am UTC](https://discuss.elastic.co/t/roles-permissions-privileges/376984 "2025-04-14T08:43:18Z")
i need to define a user role with the ability to only access security dashboard in kibana to see alerts but not to see rules or other things. i have tried the below permissions, but i can't see the security UI board. P… --- ## [Does Common Event Format (CEF) not allow a custom ingestion pipeline?](https://discuss.elastic.co/t/does-common-event-format-cef-not-allow-a-custom-ingestion-pipeline/377009)
**Author:** [@Cristina\_Marletta\_Li](https://discuss.elastic.co/u/Cristina_Marletta_Li)\ **Replies:** 4\ **Last updated:** [April 11, 2025, 4:18pm UTC](https://discuss.elastic.co/t/does-common-event-format-cef-not-allow-a-custom-ingestion-pipeline/377009 "2025-04-11T16:18:24Z")
Hi, CEF integration does not allow to add a custom ingestion policy? Is this correct? --- ## [Domain Generation Algorithm (DGA) Card NOT Appearing](https://discuss.elastic.co/t/domain-generation-algorithm-dga-card-not-appearing/377024)
**Author:** [@warren.cruz](https://discuss.elastic.co/u/warren.cruz)\ **Replies:** 0\ **Last updated:** [April 11, 2025, 5:58am UTC](https://discuss.elastic.co/t/domain-generation-algorithm-dga-card-not-appearing/377024 "2025-04-11T05:58:17Z")
Good day. I've gone through the steps outlined in this document: Domain Generation Algorithm Detection | Elastic integrations | Elastic However, when I try to add the preconfigured anomaly jobs, the DGA card does not a… --- ## [Annoying problem while browsing the detection rules](https://discuss.elastic.co/t/annoying-problem-while-browsing-the-detection-rules/376781)
**Author:** [@Ruben2](https://discuss.elastic.co/u/Ruben2)\ **Replies:** 1\ **Last updated:** [April 7, 2025, 2:23pm UTC](https://discuss.elastic.co/t/annoying-problem-while-browsing-the-detection-rules/376781 "2025-04-07T14:23:36Z")
Hello all, I have this really annoying problem where I want to scroll and look at the pre-built Elastic rules and there are 1200+ of them. When I go to the next page or any other page than the first one, my kibana porta… --- ## [How to handle host specific (maintenance) exceptions for SIEM security rules?](https://discuss.elastic.co/t/how-to-handle-host-specific-maintenance-exceptions-for-siem-security-rules/376584)
**Author:** [@falk](https://discuss.elastic.co/u/falk)\ **Replies:** 1\ **Last updated:** [April 7, 2025, 10:18am UTC](https://discuss.elastic.co/t/how-to-handle-host-specific-maintenance-exceptions-for-siem-security-rules/376584 "2025-04-07T10:18:27Z")
Hello, is there a way/what is the preferred way to exclude Elastic Agents/hosts under maintenance (the client system themselves) from security alerts? Basically: do an exception to one or more hosts under maintenance. … --- ## [Elastic SIEM Alert hostname missing](https://discuss.elastic.co/t/elastic-siem-alert-hostname-missing/376858)
**Author:** [@axvfvv79zcx57xv7k](https://discuss.elastic.co/u/axvfvv79zcx57xv7k)\ **Replies:** 0\ **Last updated:** [April 7, 2025, 10:09am UTC](https://discuss.elastic.co/t/elastic-siem-alert-hostname-missing/376858 "2025-04-07T10:09:16Z")
Hello, I'm currently using Elastic SIEM and trying to troubleshoot an issue regarding some detection rules. For several rules — for example, "Unusual File Transfer Utility Launched" (which monitors tools like rsync, scp… --- ## [EQL Detection Rule issues](https://discuss.elastic.co/t/eql-detection-rule-issues/376641)
**Author:** [@Kiwisaki](https://discuss.elastic.co/u/Kiwisaki)\ **Replies:** 1\ **Last updated:** [April 4, 2025, 5:21pm UTC](https://discuss.elastic.co/t/eql-detection-rule-issues/376641 "2025-04-04T17:21:19Z")
Hi, So i'm having some issues with my EQL detection rules. One of the use cases im running with is a possible BF attempt on a windows host. I currently have the following EQL in place which returns results fine in timel… --- ## [Policy response failure - endpoint service missed 3 check ins](https://discuss.elastic.co/t/policy-response-failure-endpoint-service-missed-3-check-ins/376597)
**Author:** [@elastic\_fan](https://discuss.elastic.co/u/elastic_fan)\ **Replies:** 3\ **Last updated:** [April 4, 2025, 3:13pm UTC](https://discuss.elastic.co/t/policy-response-failure-endpoint-service-missed-3-check-ins/376597 "2025-04-04T15:13:05Z")
Hello, I have a similar issue to Elastic Endpoint service failed (missed 3 check-ins) One of my Linux machines is reporting as unhealthy since Elastic EDR was installed. We have attempted Elastic Agent reinstalls a fe… --- ## [Osquery Manager Feedback](https://discuss.elastic.co/t/osquery-manager-feedback/376784)
**Author:** [@daniel-san](https://discuss.elastic.co/u/daniel-san)\ **Replies:** 0\ **Last updated:** [April 4, 2025, 11:05am UTC](https://discuss.elastic.co/t/osquery-manager-feedback/376784 "2025-04-04T11:05:15Z")
The Live query dont show its results straight away. When we review the ingested data in Discover, everything is fine. But the "preview" section in live query UI is always timing out (pending). The agent responded and the… --- ## [EQL query debugging options](https://discuss.elastic.co/t/eql-query-debugging-options/376777)
**Author:** [@ondrej\_fleshled](https://discuss.elastic.co/u/ondrej_fleshled)\ **Replies:** 0\ **Last updated:** [April 4, 2025, 5:26am UTC](https://discuss.elastic.co/t/eql-query-debugging-options/376777 "2025-04-04T05:26:53Z")
DEAR gents, I am trying to compila my first EQL search on ingested syslog events from IDS for port scan to destination IP to raise a hit. I am using prebuilt rule for it also complining own one but no hitted event. I … --- ## [Packetbeat\_dns\_tunneling ML job Bug](https://discuss.elastic.co/t/packetbeat-dns-tunneling-ml-job-bug/376661)
**Author:** [@warren.cruz](https://discuss.elastic.co/u/warren.cruz)\ **Replies:** 2\ **Last updated:** [April 3, 2025, 1:54am UTC](https://discuss.elastic.co/t/packetbeat-dns-tunneling-ml-job-bug/376661 "2025-04-03T01:54:04Z")
The packetbeat\_dns\_tunneling ML job still expects that the Packetbeat index template is applied. This is an issue when Elastic Agent is used. Issue was previously discussed here: Datafeed \[datafeed-packetbeat\_dns\_tun… --- ## [Closing an alert in Elastic Security without using the GUI](https://discuss.elastic.co/t/closing-an-alert-in-elastic-security-without-using-the-gui/376313)
**Author:** [@cyberm](https://discuss.elastic.co/u/cyberm)\ **Replies:** 0\ **Last updated:** [March 24, 2025, 10:50am UTC](https://discuss.elastic.co/t/closing-an-alert-in-elastic-security-without-using-the-gui/376313 "2025-03-24T10:50:37Z")
Hi everyone, I’m looking for the best strategy to close an alert in Elastic Security from an external source, without using the Kibana GUI. I’ve considered using the APIs, but I’d like to understand the best practices r… --- ## [ML anomaly detection alert](https://discuss.elastic.co/t/ml-anomaly-detection-alert/376374)
**Author:** [@sunith](https://discuss.elastic.co/u/sunith)\ **Replies:** 0\ **Last updated:** [March 25, 2025, 10:36am UTC](https://discuss.elastic.co/t/ml-anomaly-detection-alert/376374 "2025-03-25T10:36:44Z")
Hello, Could anyone please help me with this? I am working on machine learning-based anomaly detection use cases using Elastic’s built-in anomaly detection job, "auth\_rare\_hour\_for\_a\_user". I integrated this job into a… --- ## [Network Beaconing Identification Integration](https://discuss.elastic.co/t/network-beaconing-identification-integration/376031)
**Author:** [@Akodo](https://discuss.elastic.co/u/Akodo)\ **Replies:** 0\ **Last updated:** [March 17, 2025, 8:01pm UTC](https://discuss.elastic.co/t/network-beaconing-identification-integration/376031 "2025-03-17T20:01:16Z")
I'm currently setting up Network Beaconing Identification, and I'm fairly new to how Elastic has Agent Policies and where would one need to install an integration to correlate said logs. My thinking is, I should install … --- ## [Eventing only 8.13.3 W11 24H2 High CPU Load - EventsQueueThread](https://discuss.elastic.co/t/eventing-only-8-13-3-w11-24h2-high-cpu-load-eventsqueuethread/375944)
**Author:** [@t5r4e3](https://discuss.elastic.co/u/t5r4e3)\ **Replies:** 1\ **Last updated:** [March 17, 2025, 3:21pm UTC](https://discuss.elastic.co/t/eventing-only-8-13-3-w11-24h2-high-cpu-load-eventsqueuethread/375944 "2025-03-17T15:21:42Z")
Elastic Agent v8.13.3 w/ Elastic Endpoint on Windows 11 Enterprise 24H2 (10.0.26100.3194) doing only event collection (protections disabled) shows a baseline of 8% CPU load, with periodic sustained spikes up to 78%. The… --- ## [Q rel ESA-2025-06](https://discuss.elastic.co/t/q-rel-esa-2025-06/375692)
**Author:** [@fizek](https://discuss.elastic.co/u/fizek)\ **Replies:** 6\ **Last updated:** [March 12, 2025, 5:56am UTC](https://discuss.elastic.co/t/q-rel-esa-2025-06/375692 "2025-03-12T05:56:15Z")
ESA-2025-06 is a security advisory about a prototype pollution vulnerability. This avisory references the following CVE ID : CVE-2025-25012 Is self-hosted kibana in enterprise version affected? It is not clear in above… --- ## [Create a condition in EQL/ES|QL query for alert](https://discuss.elastic.co/t/create-a-condition-in-eql-es-ql-query-for-alert/375755)
**Author:** [@Discentius\_Crux](https://discuss.elastic.co/u/Discentius_Crux)\ **Replies:** 0\ **Last updated:** [March 12, 2025, 3:32am UTC](https://discuss.elastic.co/t/create-a-condition-in-eql-es-ql-query-for-alert/375755 "2025-03-12T03:32:29Z")
Hi, Can we create a condition using EQL or ESQL query to raise an alert? such as if there is any failed login more than twice then followed up by success it will raise? { "query": """ sequence by user.name with… --- ## [Error code 500](https://discuss.elastic.co/t/error-code-500/375739)
**Author:** [@Esha](https://discuss.elastic.co/u/Esha)\ **Replies:** 0\ **Last updated:** [March 11, 2025, 8:22pm UTC](https://discuss.elastic.co/t/error-code-500/375739 "2025-03-11T20:22:19Z")
Received error message below when trying to import rule to Elastic security. "Cannot use 'in' operator to search for 'investigation\_fields' Has anyone encountered this before and anyone can advise on this? Thank you --- ## [Agent block windows update](https://discuss.elastic.co/t/agent-block-windows-update/375551)
**Author:** [@Charles\_Nkuna](https://discuss.elastic.co/u/Charles_Nkuna)\ **Replies:** 3\ **Last updated:** [March 10, 2025, 8:15pm UTC](https://discuss.elastic.co/t/agent-block-windows-update/375551 "2025-03-10T20:15:40Z")
Hello, After installing elastic agent(8.15.2) enabling elastic defend on when we apply windows updates they getting blocked. what might cause the issue ? anything i need to refine ? Kind regards, Charlie --- ## [Unusual Remote File Size Rule Anomaly](https://discuss.elastic.co/t/unusual-remote-file-size-rule-anomaly/375584)
**Author:** [@warren.cruz](https://discuss.elastic.co/u/warren.cruz)\ **Replies:** 0\ **Last updated:** [March 8, 2025, 5:53am UTC](https://discuss.elastic.co/t/unusual-remote-file-size-rule-anomaly/375584 "2025-03-08T05:53:07Z")
Good day. I duplicated the prebuilt rule "Unusual Remote File Size" and set out to test it. I was able to generate an anomaly the 1st time for 1GB+. But subsequent file drops were not triggering an anomaly no matter th… [Previous page](https://discuss.elastic.co/c/security/83.md?page=5) [Next page](https://discuss.elastic.co/c/security/83.md?page=7)