# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=62 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 63 --- ## [Bytes In / Bytes Out Empty](https://discuss.elastic.co/t/bytes-in-bytes-out-empty/232441)
**Author:** [@insanity13](https://discuss.elastic.co/u/insanity13)\ **Replies:** 1\ **Last updated:** [May 13, 2020, 10:36pm UTC](https://discuss.elastic.co/t/bytes-in-bytes-out-empty/232441 "2020-05-13T22:36:34Z")
Elastic Cloud with APM via .NET Classic Agent. Goes to the SIEM Source IPs, and see that Bytes In / Bytes Out are Empty AMP transaction contains request and response length. So I think these fields should be filled. --- ## [SIEM Network Page Queries all indexes](https://discuss.elastic.co/t/siem-network-page-queries-all-indexes/231490)
**Author:** [@PhilA](https://discuss.elastic.co/u/PhilA)\ **Replies:** 4\ **Last updated:** [May 13, 2020, 2:31pm UTC](https://discuss.elastic.co/t/siem-network-page-queries-all-indexes/231490 "2020-05-13T14:31:26Z")
Hi I have recently spent a lot of time getting a few of my data sources ingested in ECS format so that I can get the benefits from the SIEM capability. Some data comes direct from the \*beats tools but some are via Logs… --- ## [Timelines Event Renderer - Why I don't see this in my timeline](https://discuss.elastic.co/t/timelines-event-renderer-why-i-dont-see-this-in-my-timeline/231258)
**Author:** [@hilo21](https://discuss.elastic.co/u/hilo21)\ **Replies:** 3\ **Last updated:** [May 6, 2020, 9:14pm UTC](https://discuss.elastic.co/t/timelines-event-renderer-why-i-dont-see-this-in-my-timeline/231258 "2020-05-06T21:14:15Z")
So, I was parsing Fortigate events in a compliant way to ECS with some enrichment by adding categorization fields with logstash but instead of getting this : I get this : Even though I respected categorization fiel… --- ## [False Positive - RPC (Remote Procedure Call) to the Internet (Kuery)](https://discuss.elastic.co/t/false-positive-rpc-remote-procedure-call-to-the-internet-kuery/231178)
**Author:** [@Gary\_Blackwell](https://discuss.elastic.co/u/Gary_Blackwell)\ **Replies:** 2\ **Last updated:** [May 6, 2020, 8:46pm UTC](https://discuss.elastic.co/t/false-positive-rpc-remote-procedure-call-to-the-internet-kuery/231178 "2020-05-06T20:46:47Z")
There is a built-in detection rule watching for TCP traffic on port 135 to the Internet. network.transport: tcp and destination.port: 135 and (network.direction: outbound or (source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 19… --- ## [Do we have SIEM dashboards and detection anomaly for DHCP logs?](https://discuss.elastic.co/t/do-we-have-siem-dashboards-and-detection-anomaly-for-dhcp-logs/231161)
**Author:** [@sundar\_elk](https://discuss.elastic.co/u/sundar_elk)\ **Replies:** 3\ **Last updated:** [May 6, 2020, 5:27pm UTC](https://discuss.elastic.co/t/do-we-have-siem-dashboards-and-detection-anomaly-for-dhcp-logs/231161 "2020-05-06T17:27:10Z")
Hi Team, I have on boarded DHCP logs into ELK and looking for SIEM detection anomaly for DHCP logs. I didn't seen anything dashboard related for DHCP logs in SIEM DHCP logs example :-1 Fields: ID,Date,Time,Descriptio… --- ## [Endpoint API changes?](https://discuss.elastic.co/t/endpoint-api-changes/230651)
**Author:** [@boss6](https://discuss.elastic.co/u/boss6)\ **Replies:** 1\ **Last updated:** [May 4, 2020, 1:25pm UTC](https://discuss.elastic.co/t/endpoint-api-changes/230651 "2020-05-04T13:25:39Z")
Hi, I had been importing endpoints via the api and until yesterday the job was working fine, but now it appears that transaction\_id is required? If so, how is it passed? I've tried a bunch and it never works. I had b… --- ## [Field case sensitivity and detection rules not triggering 'clear-eventlog'](https://discuss.elastic.co/t/field-case-sensitivity-and-detection-rules-not-triggering-clear-eventlog/230167)
**Author:** [@jimmburton](https://discuss.elastic.co/u/jimmburton)\ **Replies:** 3\ **Last updated:** [April 29, 2020, 2:57pm UTC](https://discuss.elastic.co/t/field-case-sensitivity-and-detection-rules-not-triggering-clear-eventlog/230167 "2020-04-29T14:57:44Z")
I have an new on-prem deployment of ELK 7.6.2, and have been working the the SIEM tool and like in another post about not seeing a signal get triggered when clearing logs I had the same issue. I worked through the winlog… --- ## [False positive submission](https://discuss.elastic.co/t/false-positive-submission/230041)
**Author:** [@hamza.g](https://discuss.elastic.co/u/hamza.g)\ **Replies:** 1\ **Last updated:** [April 28, 2020, 7:40pm UTC](https://discuss.elastic.co/t/false-positive-submission/230041 "2020-04-28T19:40:11Z")
Hi, Could you please check this file, as I think it is a false detection. This file has been falsely detected as malware link for the issue : https://www.virustotal.com/gui/file/8363488f279f0f972e048c10aa171a007669b3… --- ## [Prebuilt ML Jobs cant be activated](https://discuss.elastic.co/t/prebuilt-ml-jobs-cant-be-activated/229138)
**Author:** [@david-vazquez](https://discuss.elastic.co/u/david-vazquez)\ **Replies:** 10\ **Last updated:** [April 25, 2020, 3:58pm UTC](https://discuss.elastic.co/t/prebuilt-ml-jobs-cant-be-activated/229138 "2020-04-25T15:58:50Z")
Hello all, I´m trying to activate all prebuilt Machine Learning Jobs, but cant success it. I Try to active them from the SIEM "Anomalies Detection" menu, but mostly jobs don´t get activated. More properly, I could act… --- ## [Signal SIEM Detections using log files](https://discuss.elastic.co/t/signal-siem-detections-using-log-files/226667)
**Author:** [@david-vazquez](https://discuss.elastic.co/u/david-vazquez)\ **Replies:** 4\ **Last updated:** [April 25, 2020, 12:26am UTC](https://discuss.elastic.co/t/signal-siem-detections-using-log-files/226667 "2020-04-25T00:26:44Z")
Hello, I ingested some data from firewall devices of which I would like to create rules in the Detections part of the Elastic SIEM. I created a rule to detect Malware using a field of the log file which has that inform… --- ## [Lots of unmapped fields in .siem-signals-default](https://discuss.elastic.co/t/lots-of-unmapped-fields-in-siem-signals-default/229594)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 3\ **Last updated:** [April 24, 2020, 1:56pm UTC](https://discuss.elastic.co/t/lots-of-unmapped-fields-in-siem-signals-default/229594 "2020-04-24T13:56:11Z")
Hello, There seem to be quite a bit of unmapped fields in .siem-signals-default index. I tried refreshing the index pattern, but the fields are not added. The result is I can't use certain fields: For example a searc… --- ## [Can you please confirm this is false positive and update it in virus total engine?](https://discuss.elastic.co/t/can-you-please-confirm-this-is-false-positive-and-update-it-in-virus-total-engine/229450)
**Author:** [@hamza.g](https://discuss.elastic.co/u/hamza.g)\ **Replies:** 1\ **Last updated:** [April 23, 2020, 3:52pm UTC](https://discuss.elastic.co/t/can-you-please-confirm-this-is-false-positive-and-update-it-in-virus-total-engine/229450 "2020-04-23T15:52:02Z")
Hi, Could you please check this file, as I think it is a false detection. I've send mails to info@endgame.com but i didn't get any response This file has been falsely detected as malware link for the issue : https://… --- ## [SIEM does not show data](https://discuss.elastic.co/t/siem-does-not-show-data/229010)
**Author:** [@Minh\_Ti\_n\_Tr\_n](https://discuss.elastic.co/u/Minh_Ti_n_Tr_n)\ **Replies:** 7\ **Last updated:** [April 23, 2020, 7:50am UTC](https://discuss.elastic.co/t/siem-does-not-show-data/229010 "2020-04-23T07:50:13Z")
I got the problem: Fielddata is disabled on text fields by default. Set fielddata=true on \[source.ip\] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant me… --- ## [Kibana SIEM display problem just spinning no error](https://discuss.elastic.co/t/kibana-siem-display-problem-just-spinning-no-error/228488)
**Author:** [@Bartekk](https://discuss.elastic.co/u/Bartekk)\ **Replies:** 7\ **Last updated:** [April 22, 2020, 2:18pm UTC](https://discuss.elastic.co/t/kibana-siem-display-problem-just-spinning-no-error/228488 "2020-04-22T14:18:48Z")
Hi i've problem in SIEM/NETWORK/Flows i've just spinning ring and nothing displays , before update everything was fine. and log https://pastebin.pl/view/88c362e3 i dont see nothing special here ;/ No idea how to fix … --- ## [Aggregation of incoming events on common fields for SIEM usecase](https://discuss.elastic.co/t/aggregation-of-incoming-events-on-common-fields-for-siem-usecase/229206)
**Author:** [@ParashB](https://discuss.elastic.co/u/ParashB)\ **Replies:** 0\ **Last updated:** [April 22, 2020, 8:26am UTC](https://discuss.elastic.co/t/aggregation-of-incoming-events-on-common-fields-for-siem-usecase/229206 "2020-04-22T08:26:36Z")
How can I do aggregation of incoming events on common fields to reduce the incoming EPS? Refer the AGGREGATION OF EVENTS section in "https://socprime.com/en/blog/arcsight-optimizing-eps-aggregation-and-filtration/" for m… --- ## [How to apply Third Party or Custom Threat intel feeds with SIEM App?](https://discuss.elastic.co/t/how-to-apply-third-party-or-custom-threat-intel-feeds-with-siem-app/228312)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 2\ **Last updated:** [April 22, 2020, 2:58am UTC](https://discuss.elastic.co/t/how-to-apply-third-party-or-custom-threat-intel-feeds-with-siem-app/228312 "2020-04-22T02:58:32Z")
Hi Guys, Can anyone please suggest me the way to apply third party threat intel feed to SIEM App? Has that to be done with logstash translate dictionary feature? but since there are multiple indices involved can someone… --- ## [Signal Detection Rules](https://discuss.elastic.co/t/signal-detection-rules/219887)
**Author:** [@tanner8302](https://discuss.elastic.co/u/tanner8302)\ **Replies:** 11\ **Last updated:** [April 21, 2020, 11:08am UTC](https://discuss.elastic.co/t/signal-detection-rules/219887 "2020-04-21T11:08:23Z")
These don't seem to be working for me. I have enabled all rules for Linux and Windows. There are two rules based upon the whoami command. One for windows and one for linux. I performed the whoami command on both host… --- ## [Can i write elastic query using KQL or Lucene](https://discuss.elastic.co/t/can-i-write-elastic-query-using-kql-or-lucene/227337)
**Author:** [@Saurabh\_Singh1](https://discuss.elastic.co/u/Saurabh_Singh1)\ **Replies:** 2\ **Last updated:** [April 21, 2020, 4:19am UTC](https://discuss.elastic.co/t/can-i-write-elastic-query-using-kql-or-lucene/227337 "2020-04-21T04:19:44Z")
I was trying to replicate watcher functionality using SIEM detection rule. In watcher i can write elastic query, but can i perform that using detection rule ? Please help. --- ## [Can you confirm this is false positive?](https://discuss.elastic.co/t/can-you-confirm-this-is-false-positive/228528)
**Author:** [@j0taDasFestasPT](https://discuss.elastic.co/u/j0taDasFestasPT)\ **Replies:** 1\ **Last updated:** [April 20, 2020, 3:18pm UTC](https://discuss.elastic.co/t/can-you-confirm-this-is-false-positive/228528 "2020-04-20T15:18:37Z")
Hi guys this 2 files were made by a github member for Folding at home project to display the protein that the program is working on, Virustotal triggered "Malicious (high Confidence)" only on your antivirus. Can you con… --- ## [Prebuilt ML jobs fail](https://discuss.elastic.co/t/prebuilt-ml-jobs-fail/227309)
**Author:** [@kfs](https://discuss.elastic.co/u/kfs)\ **Replies:** 9\ **Last updated:** [April 20, 2020, 1:02pm UTC](https://discuss.elastic.co/t/prebuilt-ml-jobs-fail/227309 "2020-04-20T13:02:44Z")
Hi, I have an issue with starting prebuilt ML jobs that use winlogbeat\* data. The job logs show that lookback returned no data but actually I am pretty sure that it is as SIEM dashboard shows winlogbeat events coming fr… --- ## [Elastic SIEM does not show the netflow data using filebeat](https://discuss.elastic.co/t/elastic-siem-does-not-show-the-netflow-data-using-filebeat/228771)
**Author:** [@Minh\_Ti\_n\_Tr\_n](https://discuss.elastic.co/u/Minh_Ti_n_Tr_n)\ **Replies:** 0\ **Last updated:** [April 20, 2020, 2:58am UTC](https://discuss.elastic.co/t/elastic-siem-does-not-show-the-netflow-data-using-filebeat/228771 "2020-04-20T02:58:28Z")
Hi all, I configured filebeat netflow module to receive netflow log from pfsense It shows data received but don't show anything on visualize Any solution to solve that? Please let me know if you need any config f… --- ## [Rules in ElasticSIEM not create signals](https://discuss.elastic.co/t/rules-in-elasticsiem-not-create-signals/228068)
**Author:** [@Nazarenko](https://discuss.elastic.co/u/Nazarenko)\ **Replies:** 4\ **Last updated:** [April 16, 2020, 2:23pm UTC](https://discuss.elastic.co/t/rules-in-elasticsiem-not-create-signals/228068 "2020-04-16T14:23:48Z")
Hello, i have some problem with rules in ElasticSIEM. I have a lot of indexies but in on of them rules don't working. Messages about error rules are absent. WIth one index rule are working but when i write rule for other… --- ## [ECS common schema taxonomies for other sources](https://discuss.elastic.co/t/ecs-common-schema-taxonomies-for-other-sources/228220)
**Author:** [@rossw](https://discuss.elastic.co/u/rossw)\ **Replies:** 1\ **Last updated:** [April 16, 2020, 11:20am UTC](https://discuss.elastic.co/t/ecs-common-schema-taxonomies-for-other-sources/228220 "2020-04-16T11:20:31Z")
Hi there We are looking at pushing events from a lot of our network and security devices into Elastic for storage, and utilising the SIEM functionality as well. We understand the requirement for ECS, and we have starte… --- ## [SOAR for elk](https://discuss.elastic.co/t/soar-for-elk/228133)
**Author:** [@oumy](https://discuss.elastic.co/u/oumy)\ **Replies:** 2\ **Last updated:** [April 16, 2020, 11:03am UTC](https://discuss.elastic.co/t/soar-for-elk/228133 "2020-04-16T11:03:02Z")
Hello there, i was wondering if there is an open source SOAR that can be integrated with elk stack, and if so how to do so? and does any of you know how too integrate PatrOwl with elk stack? Thank you --- ## [Sizing Parameters for deploying SIEM](https://discuss.elastic.co/t/sizing-parameters-for-deploying-siem/228240)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 0\ **Last updated:** [April 16, 2020, 4:29am UTC](https://discuss.elastic.co/t/sizing-parameters-for-deploying-siem/228240 "2020-04-16T04:29:18Z")
Hi Guys, I am planning to test out SIEM app in production and I have around 70-80 servers \[60 of are those Windows/rest are all Linux/Unix\] then have PAN Firewall, 4-5 Cisco routers. So around 90 off devices that needs… --- ## [bulkResponse had errors with response statuses:counts of... {](https://discuss.elastic.co/t/bulkresponse-had-errors-with-response-statuses-counts-of/226492)
**Author:** [@larryzhu](https://discuss.elastic.co/u/larryzhu)\ **Replies:** 5\ **Last updated:** [April 15, 2020, 1:28pm UTC](https://discuss.elastic.co/t/bulkresponse-had-errors-with-response-statuses-counts-of/226492 "2020-04-15T13:28:56Z")
We consistently hit the invalid request error in elastic SIEM Found 10000 signals from the indexes of "\[oci-audit-span\*\]" using signal rule name: "OCI Audit: Delete VCN \[Duplicate\]", id: "0e2d1191-7600-4268-be75-0f13ce1… --- ## [IP Watch List Functionality](https://discuss.elastic.co/t/ip-watch-list-functionality/223583)
**Author:** [@derricksong](https://discuss.elastic.co/u/derricksong)\ **Replies:** 6\ **Last updated:** [April 15, 2020, 5:04am UTC](https://discuss.elastic.co/t/ip-watch-list-functionality/223583 "2020-04-15T05:04:49Z")
Hello, Trying to implement an IP Watch List in SIEM and wondering if there was any guidance/best practices in doing so. I currently have an index where new malicious IP objects are logged on a regular basis, let's say … --- ## [Login Issue between Strigo and Endpoint Security Fundamentals Course (training.elastic.co)](https://discuss.elastic.co/t/login-issue-between-strigo-and-endpoint-security-fundamentals-course-training-elastic-co/227966)
**Author:** [@turnermd86](https://discuss.elastic.co/u/turnermd86)\ **Replies:** 1\ **Last updated:** [April 14, 2020, 9:04pm UTC](https://discuss.elastic.co/t/login-issue-between-strigo-and-endpoint-security-fundamentals-course-training-elastic-co/227966 "2020-04-14T21:04:41Z")
After enrolling into the Endpoint Security Fundamentals Course, I reviewed the course from my training.elastic.co dashboard under "My Learning." This launched a new tab for the course with this url: scorm.servicerocket.i… --- ## [Zeek filebeat - HTTP and TLS events not fully populating](https://discuss.elastic.co/t/zeek-filebeat-http-and-tls-events-not-fully-populating/224830)
**Author:** [@lw24](https://discuss.elastic.co/u/lw24)\ **Replies:** 3\ **Last updated:** [April 11, 2020, 11:14am UTC](https://discuss.elastic.co/t/zeek-filebeat-http-and-tls-events-not-fully-populating/224830 "2020-04-11T11:14:10Z")
I have a Security Onion VM with Filebeats on it with Zeek module enabled. I've edited the zeek.yml file to point to /nsm/bro/logs/current and have all the events being pulled through to Kibana. DNS events are fully popu… --- ## [SIEM doesn't show any Winlogbeat events, despite ES receiving them](https://discuss.elastic.co/t/siem-doesnt-show-any-winlogbeat-events-despite-es-receiving-them/224008)
**Author:** [@Aura](https://discuss.elastic.co/u/Aura)\ **Replies:** 11\ **Last updated:** [April 10, 2020, 8:38pm UTC](https://discuss.elastic.co/t/siem-doesnt-show-any-winlogbeat-events-despite-es-receiving-them/224008 "2020-04-10T20:38:13Z")
Hi, New ELK stack user here. I just installed v7.6.1 on a Ubuntu Server 18.04 that I have running on an old Lenovo I had lying around. Took me a couple of hours to install, set up, and get working. One issue I can't see… [Previous page](https://discuss.elastic.co/c/security/83.md?page=61) [Next page](https://discuss.elastic.co/c/security/83.md?page=63)