# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=63 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 64 --- ## [Detections will not setup](https://discuss.elastic.co/t/detections-will-not-setup/227297)
**Author:** [@xennn](https://discuss.elastic.co/u/xennn)\ **Replies:** 4\ **Last updated:** [April 10, 2020, 5:41pm UTC](https://discuss.elastic.co/t/detections-will-not-setup/227297 "2020-04-10T17:41:11Z")
Hello, i have a problem with setup detections in SIEM. I always get a message with Let's set up your detection engine. I have logged in as a superuser i cannot see the .siem-signals index. I have check the role i hav… --- ## [Adding a condition in detection engine](https://discuss.elastic.co/t/adding-a-condition-in-detection-engine/227331)
**Author:** [@Saurabh\_Singh1](https://discuss.elastic.co/u/Saurabh_Singh1)\ **Replies:** 1\ **Last updated:** [April 10, 2020, 1:35pm UTC](https://discuss.elastic.co/t/adding-a-condition-in-detection-engine/227331 "2020-04-10T13:35:24Z")
Hi Team, Can we write an elastic query in condition while defining Detection Rule. I was generating alert using WATCHERS. IT had input , condition and output. I wanted to replicate this functionality using DETECTION … --- ## [Display log information](https://discuss.elastic.co/t/display-log-information/227380)
**Author:** [@Gary\_Blackwell](https://discuss.elastic.co/u/Gary_Blackwell)\ **Replies:** 0\ **Last updated:** [April 9, 2020, 5:45pm UTC](https://discuss.elastic.co/t/display-log-information/227380 "2020-04-09T17:45:27Z")
The default display "\_source" has a lot of uninteresting data. So I went to advanced settings and modified the default columns to be "winlog.event\_id, event.action, winlog.event\_data.SubjectUserName, winlog.event\_data.Su… --- ## [Host.hostname field\_data issue with SIEM and auditbeat](https://discuss.elastic.co/t/host-hostname-field-data-issue-with-siem-and-auditbeat/226945)
**Author:** [@rgeisman](https://discuss.elastic.co/u/rgeisman)\ **Replies:** 0\ **Last updated:** [April 7, 2020, 3:56pm UTC](https://discuss.elastic.co/t/host-hostname-field-data-issue-with-siem-and-auditbeat/226945 "2020-04-07T15:56:45Z")
Hello All, I am setting up an ELK stack and auditbeat and filebeat are sending logs to logstash and ingesting them correctly in Elasticsearch. When I go to SIEM, an error is thrown in the host and network section that … --- ## [How to handle network.direction:unknown?](https://discuss.elastic.co/t/how-to-handle-network-direction-unknown/226143)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 2\ **Last updated:** [April 4, 2020, 4:29pm UTC](https://discuss.elastic.co/t/how-to-handle-network-direction-unknown/226143 "2020-04-04T16:29:14Z")
I'm getting detections where the network.direction is "unknown". Upon investigation this is just the source port from a vulnerability scanner (Detectify) : "destination": { "bytes": 4128, "ip": "52.17.98.131",… --- ## [Shodan Integration](https://discuss.elastic.co/t/shodan-integration/223425)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 4\ **Last updated:** [April 1, 2020, 12:41pm UTC](https://discuss.elastic.co/t/shodan-integration/223425 "2020-04-01T12:41:18Z")
Has anyone managed to get Shodan.io alerts into Elastic SIEM? I'm trying to use kubi-ecs-logger logging library and the shodan python api to send ECS alerts and wondered if anyone is interested in collaborating? H --- ## [SIEM detections false positive](https://discuss.elastic.co/t/siem-detections-false-positive/219287)
**Author:** [@danielsnelling](https://discuss.elastic.co/u/danielsnelling)\ **Replies:** 4\ **Last updated:** [March 2, 2020, 9:50pm UTC](https://discuss.elastic.co/t/siem-detections-false-positive/219287 "2020-03-02T21:50:37Z")
We've upgraded our stack to 7.6.0 yesterday, and we love the new Detections mechanism! I'm aware these are in beta, but some of the definitions have a boolean 'or' where there should be an 'and'. This is particularly w… --- ## [7.6.1 SIEM not showing packetbeat flow asn info](https://discuss.elastic.co/t/7-6-1-siem-not-showing-packetbeat-flow-asn-info/225293)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [March 26, 2020, 9:35pm UTC](https://discuss.elastic.co/t/7-6-1-siem-not-showing-packetbeat-flow-asn-info/225293 "2020-03-26T21:35:48Z")
Hello, I was trying to enrich our flow data a bit from our Packetbeat data. Adding geoip data worked fine and showed up in SIEM, but I have some isues getting ASN info shown correctly in SIEM. So I made this processor: … --- ## [Sum of source bytes seems impossibly large](https://discuss.elastic.co/t/sum-of-source-bytes-seems-impossibly-large/219961)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 6\ **Last updated:** [March 26, 2020, 10:33am UTC](https://discuss.elastic.co/t/sum-of-source-bytes-seems-impossibly-large/219961 "2020-03-26T10:33:07Z")
Hello, Was browsing through Kibana SIEM on 7.5.2 and discovered some weird 'Bytes In', 'Bytes Out' metrics. After investigating, it seemd like some servers were sending huge amounts of traffic to my Elastic ingest nodes… --- ## [Logstash Output Dashboards](https://discuss.elastic.co/t/logstash-output-dashboards/224370)
**Author:** [@xennn](https://discuss.elastic.co/u/xennn)\ **Replies:** 0\ **Last updated:** [March 20, 2020, 7:55am UTC](https://discuss.elastic.co/t/logstash-output-dashboards/224370 "2020-03-20T07:55:49Z")
Hello, is it possible if we use a cluster to use the siem app, if we forward the logs to logstash? If we install winbeat, and configure the logstash output, we dont get the siem app working. The index was renamed to w… --- ## [Integrate Events into Elastic SIEM](https://discuss.elastic.co/t/integrate-events-into-elastic-siem/224091)
**Author:** [@david-vazquez](https://discuss.elastic.co/u/david-vazquez)\ **Replies:** 4\ **Last updated:** [March 22, 2020, 6:27pm UTC](https://discuss.elastic.co/t/integrate-events-into-elastic-siem/224091 "2020-03-22T18:27:09Z")
Hello guys, I´m new using ELK Stack. I have been parsing log data from Palo Alto Firewall and Cisco Umbrella by using Logstash to index it into Elasticsearch. It was a difficult task, because I have no experience doing… --- ## [Kibana SIEM "External Alert"](https://discuss.elastic.co/t/kibana-siem-external-alert/220643)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 3\ **Last updated:** [March 19, 2020, 11:11am UTC](https://discuss.elastic.co/t/kibana-siem-external-alert/220643 "2020-03-19T11:11:43Z")
Hello, I was wondering how we can use the 'External Alert' functionality in Kibana SIEM 7.6.0? The documentation is rather sparse (https://www.elastic.co/guide/en/siem/guide/current/detection-engine-overview.html#\_signa… --- ## [Kibana SIEM application is not displaying proper AS and GeoIP fields](https://discuss.elastic.co/t/kibana-siem-application-is-not-displaying-proper-as-and-geoip-fields/223972)
**Author:** [@Gmexican14](https://discuss.elastic.co/u/Gmexican14)\ **Replies:** 0\ **Last updated:** [March 17, 2020, 4:23pm UTC](https://discuss.elastic.co/t/kibana-siem-application-is-not-displaying-proper-as-and-geoip-fields/223972 "2020-03-17T16:23:00Z")
Hello everyone, I am having an issue when it comes to displaying GeoIP fields and AS fields in the SIEM app within Kibana. I have made sure that the fields get remapped to the appropriate ECS fields. As seen in the scr… --- ## [Host not showing up despite events being present](https://discuss.elastic.co/t/host-not-showing-up-despite-events-being-present/223105)
**Author:** [@norup](https://discuss.elastic.co/u/norup)\ **Replies:** 8\ **Last updated:** [March 13, 2020, 1:49pm UTC](https://discuss.elastic.co/t/host-not-showing-up-despite-events-being-present/223105 "2020-03-13T13:49:05Z")
I am running the elk stack on 1 ubuntu device along with filebeat, and metricbeat and this device is showing up fine with syslog data and as a host. Im running winlogbeat on another device, and shipping the logs through … --- ## [UEBA for elk](https://discuss.elastic.co/t/ueba-for-elk/223353)
**Author:** [@oumy](https://discuss.elastic.co/u/oumy)\ **Replies:** 2\ **Last updated:** [March 13, 2020, 7:54am UTC](https://discuss.elastic.co/t/ueba-for-elk/223353 "2020-03-13T07:54:06Z")
hello there is there an opensource UEBA that can be integrated with Elastic stack? and also a Netework monitoring tools --- ## [PFSense Data and ECS - Data Fetch Failure](https://discuss.elastic.co/t/pfsense-data-and-ecs-data-fetch-failure/222525)
**Author:** [@somm15](https://discuss.elastic.co/u/somm15)\ **Replies:** 1\ **Last updated:** [March 10, 2020, 9:29am UTC](https://discuss.elastic.co/t/pfsense-data-and-ecs-data-fetch-failure/222525 "2020-03-10T09:29:07Z")
Hello, I am ingesting my PFSense logs and net flow using Filebeat. Filebeat feeds LogStash and it does the enrichment with select parts of the code from there: It works pretty well, each data type in its own index. … --- ## [7.6.0 vs new signals and futher enrich ingestion](https://discuss.elastic.co/t/7-6-0-vs-new-signals-and-futher-enrich-ingestion/219211)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 9\ **Last updated:** [February 17, 2020, 8:14am UTC](https://discuss.elastic.co/t/7-6-0-vs-new-signals-and-futher-enrich-ingestion/219211 "2020-02-17T08:14:17Z")
Just updated our cluster to 7.6.0 and are wondering where to read up on utilizing the new SIEM signals and if needed how to do further ingestion enriching to enhance signals eta. Currently got winlog(+sysmon) and audit … --- ## [Alerting with actions in SIEM Detection Rules](https://discuss.elastic.co/t/alerting-with-actions-in-siem-detection-rules/221595)
**Author:** [@Or\_Biran](https://discuss.elastic.co/u/Or_Biran)\ **Replies:** 3\ **Last updated:** [March 6, 2020, 9:47pm UTC](https://discuss.elastic.co/t/alerting-with-actions-in-siem-detection-rules/221595 "2020-03-06T21:47:04Z")
Hi, I'm trying to understand how can I add alerts with actions like Slack to the SIEM rules... The only way I found is to add a Watcher on the .siem indice.. but its not it, I want to get an actual alert to Slack with … --- ## [Data not showing in SIEM, Fielddata is disabled on text fields by default](https://discuss.elastic.co/t/data-not-showing-in-siem-fielddata-is-disabled-on-text-fields-by-default/222485)
**Author:** [@eturner](https://discuss.elastic.co/u/eturner)\ **Replies:** 0\ **Last updated:** [March 6, 2020, 4:07pm UTC](https://discuss.elastic.co/t/data-not-showing-in-siem-fielddata-is-disabled-on-text-fields-by-default/222485 "2020-03-06T16:07:05Z")
Hi all I've been playing around with ELK at work for viewing our windows logs but not all the data is showing up in the SIEM module. It seems to be having an issue grabbing it with a "Fielddata is disabled on text fiel… --- ## [Building a SIEM, need help](https://discuss.elastic.co/t/building-a-siem-need-help/222007)
**Author:** [@oumy](https://discuss.elastic.co/u/oumy)\ **Replies:** 5\ **Last updated:** [March 5, 2020, 7:50am UTC](https://discuss.elastic.co/t/building-a-siem-need-help/222007 "2020-03-05T07:50:45Z")
Hello there i amtrying to build a SIEM using open source tools. using ELK, Suricata for IDS, My sql as a DB, Ngnix as web server, Opendistro for alerting and still developping the architecture. i would apreciate your h… --- ## [SIEM - "All Hosts" Not showing Operating System](https://discuss.elastic.co/t/siem-all-hosts-not-showing-operating-system/221877)
**Author:** [@markbgale](https://discuss.elastic.co/u/markbgale)\ **Replies:** 0\ **Last updated:** [March 3, 2020, 11:54am UTC](https://discuss.elastic.co/t/siem-all-hosts-not-showing-operating-system/221877 "2020-03-03T11:54:13Z")
Hi All I'm running Elastic, Beats and Kibana version 7.5.2. In SIEM under the "All Hosts" tabs the servers are listed but the Operating System and Version is showing as a dash (-). If I drill into the server it gives … --- ## [Shards failed warning on Network dashboard in SIEM app](https://discuss.elastic.co/t/shards-failed-warning-on-network-dashboard-in-siem-app/219908)
**Author:** [@wconnell](https://discuss.elastic.co/u/wconnell)\ **Replies:** 8\ **Last updated:** [March 3, 2020, 12:04am UTC](https://discuss.elastic.co/t/shards-failed-warning-on-network-dashboard-in-siem-app/219908 "2020-03-03T00:04:40Z")
Hi there, I'm getting a shards failed warning in the Network dashboard of the SIEM app (v7.6). I'm unable to diagnose as when I click the "Show details" button, nothing happens. I used the inspect tool in Chrome and it … --- ## [Elasticsearch SIEM Dashboard](https://discuss.elastic.co/t/elasticsearch-siem-dashboard/221517)
**Author:** [@yfataar](https://discuss.elastic.co/u/yfataar)\ **Replies:** 1\ **Last updated:** [March 1, 2020, 11:31pm UTC](https://discuss.elastic.co/t/elasticsearch-siem-dashboard/221517 "2020-03-01T23:31:19Z")
Hi I have a Cisco Firewall (ASA) logging data to Filebeats -\> Logstash -\> Elasticsearch. I can see the syslog data in "Discover" section however I do not have any output in SIEM section under Networks. How does the data… --- ## [How to apply log retention policies to Elastic SIEM](https://discuss.elastic.co/t/how-to-apply-log-retention-policies-to-elastic-siem/220796)
**Author:** [@anon67583212](https://discuss.elastic.co/u/anon67583212)\ **Replies:** 3\ **Last updated:** [March 1, 2020, 10:06am UTC](https://discuss.elastic.co/t/how-to-apply-log-retention-policies-to-elastic-siem/220796 "2020-03-01T10:06:30Z")
Good morning, I am doing some tests with the product and I have just come across something, at least inconsistent: you cannot apply granular log retention policies. I mean, if you want to apply a 30-day retention policy… --- ## [Detection Custom Rule not working](https://discuss.elastic.co/t/detection-custom-rule-not-working/220856)
**Author:** [@Or\_Biran](https://discuss.elastic.co/u/Or_Biran)\ **Replies:** 17\ **Last updated:** [February 29, 2020, 2:25am UTC](https://discuss.elastic.co/t/detection-custom-rule-not-working/220856 "2020-02-29T02:25:14Z")
Hi, I'm trying to create a basic custom rule on a custom index that contains logs that originated from filebeat. creating a basic rule on that index just not working, no Signals created. Using the same query showing r… --- ## [SIEM App does not display Hostnames from Beats Events](https://discuss.elastic.co/t/siem-app-does-not-display-hostnames-from-beats-events/220330)
**Author:** [@cknoell](https://discuss.elastic.co/u/cknoell)\ **Replies:** 5\ **Last updated:** [February 21, 2020, 10:12pm UTC](https://discuss.elastic.co/t/siem-app-does-not-display-hostnames-from-beats-events/220330 "2020-02-21T22:12:36Z")
Hi, we have some problems using the SIEM App and Displaying Hostnames on the Hosts Page if it comes to a setup where you use: Beats -\> Logstash -\> Logstash -\> Elastic All components are using up to date V7.6.0 Beats… --- ## [Anomaly detection - Elastic Jobs failing to start](https://discuss.elastic.co/t/anomaly-detection-elastic-jobs-failing-to-start/220015)
**Author:** [@KevSex](https://discuss.elastic.co/u/KevSex)\ **Replies:** 2\ **Last updated:** [February 21, 2020, 8:55pm UTC](https://discuss.elastic.co/t/anomaly-detection-elastic-jobs-failing-to-start/220015 "2020-02-21T20:55:04Z")
When I attempt to create an ML job using one of the pre-defined jobs for instance "windows\_rare\_user\_type10\_remote\_login", I receive the below error: \[status\_exception\] \[datafeed-windows\_rare\_user\_type10\_remote\_login\] c… --- ## [SIEM Hosts / Networks and Data Not Showing Up](https://discuss.elastic.co/t/siem-hosts-networks-and-data-not-showing-up/219848)
**Author:** [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)\ **Replies:** 4\ **Last updated:** [February 19, 2020, 4:16pm UTC](https://discuss.elastic.co/t/siem-hosts-networks-and-data-not-showing-up/219848 "2020-02-19T16:16:10Z")
New to SIEM. Confused about functionality or my settings. I have Fortinet and Sonicwall logs going to ES, via syslog to Logstash, then to ES. When I go to Elastic SIEM, under either Hosts or Network pages, I see nothin… --- ## [Hosts table : host.name (alias of beat.name) used instead of agent.hostname](https://discuss.elastic.co/t/hosts-table-host-name-alias-of-beat-name-used-instead-of-agent-hostname/219088)
**Author:** [@Georgios\_Gkinis](https://discuss.elastic.co/u/Georgios_Gkinis)\ **Replies:** 1\ **Last updated:** [February 17, 2020, 8:10pm UTC](https://discuss.elastic.co/t/hosts-table-host-name-alias-of-beat-name-used-instead-of-agent-hostname/219088 "2020-02-17T20:10:19Z")
I am using beats to forward metrics and logs to Elasticsearch. In the configuration of each beat I have setup its name manually : name: "${COMPUTERNAME}-filebeat-applications" When I go to SIEM -\> Hosts -\> table All H… --- ## [Threat signatures from observers](https://discuss.elastic.co/t/threat-signatures-from-observers/218962)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 4\ **Last updated:** [February 17, 2020, 1:29pm UTC](https://discuss.elastic.co/t/threat-signatures-from-observers/218962 "2020-02-17T13:29:53Z")
External security products, such as endpoint protection etc., often send a threat signature with their alerts ("Trojan.generic.823719237", "CVE-XXX-XXX Joomla SQL Injection"). Where do we put this threat name / signature… [Previous page](https://discuss.elastic.co/c/security/83.md?page=62) [Next page](https://discuss.elastic.co/c/security/83.md?page=64)