# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=64 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 65 --- ## ["path: /\_security/api\_key... api keys are not enabled" while loading prebuilt detection rules](https://discuss.elastic.co/t/path-security-api-key-api-keys-are-not-enabled-while-loading-prebuilt-detection-rules/219319)
**Author:** [@Slavik\_Fursov](https://discuss.elastic.co/u/Slavik_Fursov)\ **Replies:** 3\ **Last updated:** [February 16, 2020, 10:33am UTC](https://discuss.elastic.co/t/path-security-api-key-api-keys-are-not-enabled-while-loading-prebuilt-detection-rules/219319 "2020-02-16T10:33:59Z")
I upgraded to 7.6.0 today. I wanted to try Detections, but I'm getting error (below) when clicking "load prebuilt detection rules". My complete Kibana config: --- ## Default Kibana configuration from Kibana base image… --- ## [AquaSec / TwistLock features for containers?](https://discuss.elastic.co/t/aquasec-twistlock-features-for-containers/219388)
**Author:** [@elenoir](https://discuss.elastic.co/u/elenoir)\ **Replies:** 0\ **Last updated:** [February 14, 2020, 2:45pm UTC](https://discuss.elastic.co/t/aquasec-twistlock-features-for-containers/219388 "2020-02-14T14:45:48Z")
Hi, I was wondering if you plan to develop some features such as AquaSec or TwistLock provides for containers? I think this question is valuable since the Endgame buying as Elastic could cover almost the whole perimet… --- ## [Overlap between Endgame binary and Auditbeat/Packetbeat](https://discuss.elastic.co/t/overlap-between-endgame-binary-and-auditbeat-packetbeat/219386)
**Author:** [@elenoir](https://discuss.elastic.co/u/elenoir)\ **Replies:** 0\ **Last updated:** [February 14, 2020, 2:39pm UTC](https://discuss.elastic.co/t/overlap-between-endgame-binary-and-auditbeat-packetbeat/219386 "2020-02-14T14:39:12Z")
Hi, Since I've watched the Endpoint Security webinar I was wondering about the differences between endgame binary and AuditBeat/PacketBeat ones. Indeed, let's assume that the endgame binary is installed on one host, it… --- ## [SIEM app doesn't use Timezone setting](https://discuss.elastic.co/t/siem-app-doesnt-use-timezone-setting/216906)
**Author:** [@wconnell](https://discuss.elastic.co/u/wconnell)\ **Replies:** 12\ **Last updated:** [February 14, 2020, 4:28am UTC](https://discuss.elastic.co/t/siem-app-doesnt-use-timezone-setting/216906 "2020-02-14T04:28:39Z")
I set the "Timezone for date formatting" to UTC in the Advanced settings, so all my dashboards and visualizations use it as expected. However the SIEM app seems to use the browser settings which throws things off. Is the… --- ## [Auditbeat omniscience?](https://discuss.elastic.co/t/auditbeat-omniscience/218695)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 1\ **Last updated:** [February 13, 2020, 6:13pm UTC](https://discuss.elastic.co/t/auditbeat-omniscience/218695 "2020-02-13T18:13:26Z")
I have an event picked up by Auditbeat where it registers a tcp connection to my machine (port 22 where openssh is listening) from an external source. That's fine and dandy however it claims to know what the process and… --- ## [Server send security events with WEF and in Authentication tab I don't found all accesses](https://discuss.elastic.co/t/server-send-security-events-with-wef-and-in-authentication-tab-i-dont-found-all-accesses/219221)
**Author:** [@franco.federico](https://discuss.elastic.co/u/franco.federico)\ **Replies:** 0\ **Last updated:** [February 13, 2020, 2:02pm UTC](https://discuss.elastic.co/t/server-send-security-events-with-wef-and-in-authentication-tab-i-dont-found-all-accesses/219221 "2020-02-13T14:02:37Z")
Hi all I'm using Elastic Stack v7.4.0 and I have a single winlogbeat on the Windows Server that receive with WEF all event of security of differents other server. So I just correct by logstash, that I used to filter al… --- ## [Failed to installed pre-packaged rules from elastic](https://discuss.elastic.co/t/failed-to-installed-pre-packaged-rules-from-elastic/219111)
**Author:** [@wlzylal](https://discuss.elastic.co/u/wlzylal)\ **Replies:** 3\ **Last updated:** [February 13, 2020, 9:44am UTC](https://discuss.elastic.co/t/failed-to-installed-pre-packaged-rules-from-elastic/219111 "2020-02-13T09:44:07Z")
I have just upgrade my elk to 7.6.0 and I want to test the rules in SIEM, but I just can't load prebuilt detection rules. It said that // Your visualization has error(s) Failed to installed pre-packaged rules from elas… --- ## [SIEM \> Detections will not setup](https://discuss.elastic.co/t/siem-detections-will-not-setup/219035)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 1\ **Last updated:** [February 12, 2020, 3:56pm UTC](https://discuss.elastic.co/t/siem-detections-will-not-setup/219035 "2020-02-12T15:56:31Z")
Hi, I have upgraded to 7.6, going to SIEM \> Detections it comes up with Let's set up your detection engine. I have logged in as a superuser, event created a user with superuser and kibana-admin rights, still no change,… --- ## [Uploading third-party JSON output](https://discuss.elastic.co/t/uploading-third-party-json-output/218640)
**Author:** [@carenas](https://discuss.elastic.co/u/carenas)\ **Replies:** 1\ **Last updated:** [February 10, 2020, 9:03pm UTC](https://discuss.elastic.co/t/uploading-third-party-json-output/218640 "2020-02-10T21:03:28Z")
We are looking to analyze client log data that is exported (as JSON) from third-party SIEM products. Can this exported data be ingested as-is by Elastic SIEM and properly parsed? Or would we have to manually convert it… --- ## [Ip filtering on elastic cloud](https://discuss.elastic.co/t/ip-filtering-on-elastic-cloud/216233)
**Author:** [@Eladsig](https://discuss.elastic.co/u/Eladsig)\ **Replies:** 1\ **Last updated:** [February 4, 2020, 4:10pm UTC](https://discuss.elastic.co/t/ip-filtering-on-elastic-cloud/216233 "2020-02-04T16:10:53Z")
hello, i am trying to configure ip filtering for my instance on elastic cloud. i want to block all unallowed ip addresses to my elasticsearch and kibana. i tried to follow this : guide and edit User setting overrides… --- ## [Conflict between ECS and SIEM authentication events visualization](https://discuss.elastic.co/t/conflict-between-ecs-and-siem-authentication-events-visualization/216936)
**Author:** [@wconnell](https://discuss.elastic.co/u/wconnell)\ **Replies:** 2\ **Last updated:** [January 29, 2020, 7:16pm UTC](https://discuss.elastic.co/t/conflict-between-ecs-and-siem-authentication-events-visualization/216936 "2020-01-29T19:16:31Z")
On the Host tab of the SIEM app, there's a visualization that counts authentication events using the following logic: { "aggs": { "authentication\_success": { "filter": { "term": { "event.ty… --- ## [Elastic Integration with Zscaler NSS service](https://discuss.elastic.co/t/elastic-integration-with-zscaler-nss-service/211858)
**Author:** [@mountainreef](https://discuss.elastic.co/u/mountainreef)\ **Replies:** 1\ **Last updated:** [January 18, 2020, 4:38am UTC](https://discuss.elastic.co/t/elastic-integration-with-zscaler-nss-service/211858 "2020-01-18T04:38:00Z")
Hi, New here so apologies if this has been asked before? Has anyone integrated their stack with Zscalers Nanolog or NSS service for SIEM? If so is there any beats advice for connectivity, normalisation or community rule… --- ## [Blog series on macOS system extensions and EndpointSecurity framework](https://discuss.elastic.co/t/blog-series-on-macos-system-extensions-and-endpointsecurity-framework/214134)
**Author:** [@tonymeehan](https://discuss.elastic.co/u/tonymeehan)\ **Replies:** 0\ **Last updated:** [January 7, 2020, 9:20pm UTC](https://discuss.elastic.co/t/blog-series-on-macos-system-extensions-and-endpointsecurity-framework/214134 "2020-01-07T21:20:02Z")
Be sure to check out our new blog series on macOS system extension changes, the new EndpointSecurity and NetworkExtension frameworks, and tips and tricks for tacking advantage of these new systems to effectively protect … --- ## [Endgame](https://discuss.elastic.co/t/endgame/213227)
**Author:** [@odweik](https://discuss.elastic.co/u/odweik)\ **Replies:** 1\ **Last updated:** [January 7, 2020, 9:17pm UTC](https://discuss.elastic.co/t/endgame/213227 "2020-01-07T21:17:25Z")
Hello, How I can learn Endgame endpoint security --- ## [Siem anomaly detection prebuild jobs](https://discuss.elastic.co/t/siem-anomaly-detection-prebuild-jobs/213416)
**Author:** [@jittinan](https://discuss.elastic.co/u/jittinan)\ **Replies:** 1\ **Last updated:** [January 2, 2020, 4:07pm UTC](https://discuss.elastic.co/t/siem-anomaly-detection-prebuild-jobs/213416 "2020-01-02T16:07:49Z")
I am using trial version.I have installed filebeat,auditbeat,winlogbeat agent on target systems. The prebuilt jobs which i can use are siem-api-rare\_process\_linux\_ecs siem-api-rare\_process\_windows\_ecs 3.siem-api-suspi… --- ## [Unable to start auditbeat for siem](https://discuss.elastic.co/t/unable-to-start-auditbeat-for-siem/213431)
**Author:** [@irobot678](https://discuss.elastic.co/u/irobot678)\ **Replies:** 0\ **Last updated:** [December 31, 2019, 9:46am UTC](https://discuss.elastic.co/t/unable-to-start-auditbeat-for-siem/213431 "2019-12-31T09:46:25Z")
HI, im using elk stack of version 7.5.1 with x-pack installed and i cant able to start auditbeat for siem. Please help me solve it: Exiting: 2 errors: 1 error: failed to create audit client: failed to get audit status… --- ## [Endpoint Security on Elastic Stack Community Slack](https://discuss.elastic.co/t/endpoint-security-on-elastic-stack-community-slack/212696)
**Author:** [@tonymeehan](https://discuss.elastic.co/u/tonymeehan)\ **Replies:** 0\ **Last updated:** [December 20, 2019, 6:36pm UTC](https://discuss.elastic.co/t/endpoint-security-on-elastic-stack-community-slack/212696 "2019-12-20T18:36:08Z")
In case you missed the announcement, we've got a community Slack setup for discussing endpoint security. See https://twitter.com/elastic/status/1207631666362998784 for more details and join us in #endpoint-security! -To… --- ## [Howto change indices in def. ML jobs](https://discuss.elastic.co/t/howto-change-indices-in-def-ml-jobs/211620)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 2\ **Last updated:** [December 20, 2019, 10:06am UTC](https://discuss.elastic.co/t/howto-change-indices-in-def-ml-jobs/211620 "2019-12-20T10:06:19Z")
Attempting to deploy std. SIEM ML jobs, only to find that they fail as they are meant for std. index naming. Issue is that we're using a custom named indices prefixed for a SIEM PoC. So question is how may we change the… --- ## [Our ML job stops execution with an exception: EmptyDataCountException: null](https://discuss.elastic.co/t/our-ml-job-stops-execution-with-an-exception-emptydatacountexception-null/212480)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 2\ **Last updated:** [December 19, 2019, 2:58pm UTC](https://discuss.elastic.co/t/our-ml-job-stops-execution-with-an-exception-emptydatacountexception-null/212480 "2019-12-19T14:58:42Z")
Trying to run std. the various ML jobs for WIndows. Only two seems to keep running other stops again with exceptions like below. Wondering if exception happens maybe because we've still got to few sampled data yet? TIA … --- ## [SIEM Timeline data persistence and retention](https://discuss.elastic.co/t/siem-timeline-data-persistence-and-retention/212344)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 2\ **Last updated:** [December 19, 2019, 7:15am UTC](https://discuss.elastic.co/t/siem-timeline-data-persistence-and-retention/212344 "2019-12-19T07:15:20Z")
Playing a bit with SIEM App and wondering where are Timeline stored and how to possibly control their retention? Don't seem to find any godd system index candidates for this... --- ## [Elastic SIEM - Adding more data](https://discuss.elastic.co/t/elastic-siem-adding-more-data/212154)
**Author:** [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\ **Replies:** 1\ **Last updated:** [December 17, 2019, 7:44pm UTC](https://discuss.elastic.co/t/elastic-siem-adding-more-data/212154 "2019-12-17T19:44:27Z")
HI There, Iam Elastic's SIEM for security analysis, but I would like to know if can add other datas to SIEM app, for example there are many logs sources sends syslog to my logstash .Can I have those logs as well in my E… --- ## [Auditbeat fileintegrity module cannot detect file update from vi](https://discuss.elastic.co/t/auditbeat-fileintegrity-module-cannot-detect-file-update-from-vi/211920)
**Author:** [@jittinan](https://discuss.elastic.co/u/jittinan)\ **Replies:** 0\ **Last updated:** [December 15, 2019, 7:00pm UTC](https://discuss.elastic.co/t/auditbeat-fileintegrity-module-cannot-detect-file-update-from-vi/211920 "2019-12-15T19:00:57Z")
from auditbeat documents,file integrity module detect changes by using inotify events from os.it works correctly with created,deleted,moved events by sending a message for each event to elasticserch but when the monitor… --- ## [I want to access the SIEM app without clicking the SIEM app](https://discuss.elastic.co/t/i-want-to-access-the-siem-app-without-clicking-the-siem-app/211122)
**Author:** [@Vishnu\_mk](https://discuss.elastic.co/u/Vishnu_mk)\ **Replies:** 2\ **Last updated:** [December 12, 2019, 12:04pm UTC](https://discuss.elastic.co/t/i-want-to-access-the-siem-app-without-clicking-the-siem-app/211122 "2019-12-12T12:04:29Z")
I have created a space , which has privileges for only SIEM app. Can I access the SIEM app directly without clicking the SIEM . I mean the SIEM app should automatically open --- ## [Anomaly detection Statuscode 404](https://discuss.elastic.co/t/anomaly-detection-statuscode-404/211142)
**Author:** [@MisterLamp](https://discuss.elastic.co/u/MisterLamp)\ **Replies:** 4\ **Last updated:** [December 12, 2019, 9:20am UTC](https://discuss.elastic.co/t/anomaly-detection-statuscode-404/211142 "2019-12-12T09:20:41Z")
Hi, we are running our elastic stack in version 7.3.2. A handful of clients has auditbeat installend and configured and I can see the data at SIEM. We have activated the trial license to use features like anomaly detec… --- ## [I want to enable the map which is present in SIEM app](https://discuss.elastic.co/t/i-want-to-enable-the-map-which-is-present-in-siem-app/211054)
**Author:** [@Vishnu\_mk](https://discuss.elastic.co/u/Vishnu_mk)\ **Replies:** 0\ **Last updated:** [December 9, 2019, 6:06am UTC](https://discuss.elastic.co/t/i-want-to-enable-the-map-which-is-present-in-siem-app/211054 "2019-12-09T06:06:19Z")
Hi , I am having Elasticsearch version 7.4, and in the SIEM app network section I want to enable the map present. I want to enable it through my own index , so i am doing ECS mapping of my index field but when i conve… --- ## [Error receiving audit reply: no buffer space available](https://discuss.elastic.co/t/error-receiving-audit-reply-no-buffer-space-available/210382)
**Author:** [@vaclav](https://discuss.elastic.co/u/vaclav)\ **Replies:** 1\ **Last updated:** [December 9, 2019, 9:28am UTC](https://discuss.elastic.co/t/error-receiving-audit-reply-no-buffer-space-available/210382 "2019-12-09T09:28:48Z")
Hello, I am having issue with auditbeat service running, but there is no output and some commands are not working. Found this error in syslog: auditbeat\[23346\]: 2019-12-03T11:48:38.116Z#011ERROR#011\[auditd\]#011auditd/a… --- ## [False positive](https://discuss.elastic.co/t/false-positive/208846)
**Author:** [@vnovomeska](https://discuss.elastic.co/u/vnovomeska)\ **Replies:** 1\ **Last updated:** [December 6, 2019, 10:04pm UTC](https://discuss.elastic.co/t/false-positive/208846 "2019-12-06T22:04:24Z")
Hello, I encountered a false positive: https://www.virustotal.com/gui/file/9fdd641a90f64de570e08202dc0ffe9db8a94264bf969dcf16037413db49da1e/detection Endgame reports "Malicious (moderate Confidence)" but the file is s… --- ## [Pricing et al](https://discuss.elastic.co/t/pricing-et-al/205410)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 5\ **Last updated:** [December 6, 2019, 10:03pm UTC](https://discuss.elastic.co/t/pricing-et-al/205410 "2019-12-06T22:03:37Z")
How does endpoint security pricing work? After releasing such an exciting product you've made it very difficult to find / evaluate and buy Endpoint security..! H --- ## [Deal with false positives](https://discuss.elastic.co/t/deal-with-false-positives/208950)
**Author:** [@p3464782](https://discuss.elastic.co/u/p3464782)\ **Replies:** 1\ **Last updated:** [December 6, 2019, 10:00pm UTC](https://discuss.elastic.co/t/deal-with-false-positives/208950 "2019-12-06T22:00:59Z")
Can one overrule a triggered detection and response rule via e.g. the API, for example if a false positive is identified by my company? Or does the Kibana SIEM allows an analist to revert any automatic responses? --- ## [Authentication fields used by SIEM vs ECS](https://discuss.elastic.co/t/authentication-fields-used-by-siem-vs-ecs/210882)
**Author:** [@vbr](https://discuss.elastic.co/u/vbr)\ **Replies:** 3\ **Last updated:** [December 6, 2019, 5:04pm UTC](https://discuss.elastic.co/t/authentication-fields-used-by-siem-vs-ecs/210882 "2019-12-06T17:04:23Z")
Hi. We're storing security data in ES. We are not using the beats, but we are formatting data according to ECS. Unfortunately, the different values for fields are so far not well standardized, and working out how to get… [Previous page](https://discuss.elastic.co/c/security/83.md?page=63) [Next page](https://discuss.elastic.co/c/security/83.md?page=65)