# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=65 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 66 --- ## [SIEM - Any overlap between filbeat ingesting syslog, auditlog, authlog and auditbeat (with auditd, system and FI modules)?](https://discuss.elastic.co/t/siem-any-overlap-between-filbeat-ingesting-syslog-auditlog-authlog-and-auditbeat-with-auditd-system-and-fi-modules/210235)
**Author:** [@vsubrama](https://discuss.elastic.co/u/vsubrama)\ **Replies:** 2\ **Last updated:** [December 5, 2019, 10:26pm UTC](https://discuss.elastic.co/t/siem-any-overlap-between-filbeat-ingesting-syslog-auditlog-authlog-and-auditbeat-with-auditd-system-and-fi-modules/210235 "2019-12-05T22:26:14Z")
We are currently ingesting syslog, auditlog, authlog from our ubuntu systems via filebeat to Elasticsearch 7.4.2 as a part of build our SIEM. We are planning to add auditbeat with auditd, system and file integrity module… --- ## [Unable to start audit beat](https://discuss.elastic.co/t/unable-to-start-audit-beat/209594)
**Author:** [@Sudeep\_Khare](https://discuss.elastic.co/u/Sudeep_Khare)\ **Replies:** 0\ **Last updated:** [November 27, 2019, 1:38am UTC](https://discuss.elastic.co/t/unable-to-start-audit-beat/209594 "2019-11-27T01:38:14Z")
I am relatively new to ELK and I am trying to send logs from audit beat to Kibana. I have followed the steps from ELK documentation to install audit-beats on Linux . But at the last step when I run the audit beat I am ge… --- ## [An ECS compliant Kibana index pattern must be configured to view event data on the map](https://discuss.elastic.co/t/an-ecs-compliant-kibana-index-pattern-must-be-configured-to-view-event-data-on-the-map/209969)
**Author:** [@MarcusCaepio](https://discuss.elastic.co/u/MarcusCaepio)\ **Replies:** 4\ **Last updated:** [December 5, 2019, 2:02pm UTC](https://discuss.elastic.co/t/an-ecs-compliant-kibana-index-pattern-must-be-configured-to-view-event-data-on-the-map/209969 "2019-12-05T14:02:14Z")
Hi all, I am using Filebeat module cisco to get logs. I am not storing this logs in an index called filebeat-\* but cisco-\*. To get the correct mapping for this pattern, I exported the filebeat template and imported it f… --- ## [What field are used to populate the entire SIEM APP](https://discuss.elastic.co/t/what-field-are-used-to-populate-the-entire-siem-app/209263)
**Author:** [@Vishnu\_mk](https://discuss.elastic.co/u/Vishnu_mk)\ **Replies:** 2\ **Last updated:** [December 3, 2019, 9:42am UTC](https://discuss.elastic.co/t/what-field-are-used-to-populate-the-entire-siem-app/209263 "2019-12-03T09:42:01Z")
Hii Everyone, I am trying to map the fields used in my index to the ECS fields so that it gets populated in the SIEM APP. I have mapped fields like username , hostname and event action with the ECS fields and its gettin… --- ## [TheHIVE integration for SIEM Case Management](https://discuss.elastic.co/t/thehive-integration-for-siem-case-management/209129)
**Author:** [@ch3no2](https://discuss.elastic.co/u/ch3no2)\ **Replies:** 1\ **Last updated:** [November 29, 2019, 2:55pm UTC](https://discuss.elastic.co/t/thehive-integration-for-siem-case-management/209129 "2019-11-29T14:55:16Z")
In the last Elastic SIEM Presentation (11/21/2019), the presentation showed the integration with MISP... Is that the same MISP that is part of TheHive ? AND is there is there any consideration of having hooks in the SI… --- ## [Fielddata is disabled](https://discuss.elastic.co/t/fielddata-is-disabled/206816)
**Author:** [@Manoel](https://discuss.elastic.co/u/Manoel)\ **Replies:** 6\ **Last updated:** [November 28, 2019, 5:51pm UTC](https://discuss.elastic.co/t/fielddata-is-disabled/206816 "2019-11-28T17:51:20Z")
Hello. I upgraded from Elastic Stack version 6.8 to 7.4. I installed AudioBeat on all my servers, with the configuration below. auditbeat.modules: - module: auditd audit\_rule\_files: \[ '${path.config}/audit.rules.d/\*… --- ## [Auditbeat docker (7.4.2) starts and then terminates with no error](https://discuss.elastic.co/t/auditbeat-docker-7-4-2-starts-and-then-terminates-with-no-error/209348)
**Author:** [@yoshugo](https://discuss.elastic.co/u/yoshugo)\ **Replies:** 1\ **Last updated:** [November 26, 2019, 5:01pm UTC](https://discuss.elastic.co/t/auditbeat-docker-7-4-2-starts-and-then-terminates-with-no-error/209348 "2019-11-26T17:01:32Z")
Hi, i'm new to auditbeat. i've configured a test machine in my lab and configured all ELK stack as dockers. the Auditbeat starts and load dashboards and then stops. --- ## [EDR in parallel with AV](https://discuss.elastic.co/t/edr-in-parallel-with-av/208946)
**Author:** [@p3464782](https://discuss.elastic.co/u/p3464782)\ **Replies:** 1\ **Last updated:** [November 21, 2019, 7:16pm UTC](https://discuss.elastic.co/t/edr-in-parallel-with-av/208946 "2019-11-21T19:16:38Z")
Is it technically possible to run an Endgame or Elastic Endpoint Security agent in parallel with an existing AV/EPP solution like ESET, or does the agent conflicts with any AV running on the same system? --- ## [Can Someone Help me Configure Suricata Filebeat on elastic cloud?](https://discuss.elastic.co/t/can-someone-help-me-configure-suricata-filebeat-on-elastic-cloud/208962)
**Author:** [@Wilfyboy](https://discuss.elastic.co/u/Wilfyboy)\ **Replies:** 1\ **Last updated:** [November 21, 2019, 6:56pm UTC](https://discuss.elastic.co/t/can-someone-help-me-configure-suricata-filebeat-on-elastic-cloud/208962 "2019-11-21T18:56:42Z")
Here are steps I followed to install Filebeats: "C:\\Program Files\\Filebeat" cd "C:\\Program Files\\Filebeat" Edited Elastic Cloud section filebeat.yml file to add cloud.id: and cloud.auth: filebeat.exe modules enable suri… --- ## [Agent deployments multi tenancy](https://discuss.elastic.co/t/agent-deployments-multi-tenancy/208948)
**Author:** [@p3464782](https://discuss.elastic.co/u/p3464782)\ **Replies:** 0\ **Last updated:** [November 21, 2019, 5:46pm UTC](https://discuss.elastic.co/t/agent-deployments-multi-tenancy/208948 "2019-11-21T17:46:21Z")
Will the Elastic Endpoint Security cloud environment have multi-tenancy capabilities to group agents within multiple organizations/networks, for example within Kibana? --- ## [GCP VPC Flows in SIEM](https://discuss.elastic.co/t/gcp-vpc-flows-in-siem/208259)
**Author:** [@numbersix](https://discuss.elastic.co/u/numbersix)\ **Replies:** 2\ **Last updated:** [November 19, 2019, 2:16pm UTC](https://discuss.elastic.co/t/gcp-vpc-flows-in-siem/208259 "2019-11-19T14:16:08Z")
I have GCP VPC Flows in Elasticsearch but what is the easiest way to integrate them into the SIEM? I see net flow integrations available for other sources but not GCP. I'm using the Google Cloud Module for Filebeat cur… --- ## [SIEM not ingesting Forwarded Windows logs](https://discuss.elastic.co/t/siem-not-ingesting-forwarded-windows-logs/207311)
**Author:** [@mustdiee](https://discuss.elastic.co/u/mustdiee)\ **Replies:** 5\ **Last updated:** [November 14, 2019, 5:54pm UTC](https://discuss.elastic.co/t/siem-not-ingesting-forwarded-windows-logs/207311 "2019-11-14T17:54:34Z")
Hello! I'am collecting logs from all Windows PCs in my infrastructure with EventForwarding. Only one server has a winlogbeat installed, which is configured on other workstations as a subscription server (this is the eas… --- ## [In Ubuntu 18.04 auditbeat logs goes to syslog than /var/log/auditbeat](https://discuss.elastic.co/t/in-ubuntu-18-04-auditbeat-logs-goes-to-syslog-than-var-log-auditbeat/206269)
**Author:** [@Joseph\_John](https://discuss.elastic.co/u/Joseph_John)\ **Replies:** 3\ **Last updated:** [November 13, 2019, 9:03pm UTC](https://discuss.elastic.co/t/in-ubuntu-18-04-auditbeat-logs-goes-to-syslog-than-var-log-auditbeat/206269 "2019-11-13T21:03:29Z")
Hi All, Good morning I am using Ubuntu 18.04 I have auditbeat installed and running on my system, in the auditbeat.yml files I have given the following logging.level: info path.logs: /var/log/auditbeat When I chec… --- ## [Metricbeat -c /etc/metricbeat.yml logs goes to the path specified , when stating with systemctl it does not](https://discuss.elastic.co/t/metricbeat-c-etc-metricbeat-yml-logs-goes-to-the-path-specified-when-stating-with-systemctl-it-does-not/206273)
**Author:** [@Joseph\_John](https://discuss.elastic.co/u/Joseph_John)\ **Replies:** 4\ **Last updated:** [November 13, 2019, 10:54am UTC](https://discuss.elastic.co/t/metricbeat-c-etc-metricbeat-yml-logs-goes-to-the-path-specified-when-stating-with-systemctl-it-does-not/206273 "2019-11-13T10:54:22Z")
Hi All, Good morning I am experiencing a strange observation here with logs when I run metricbeat -c /etc/metricbeat/metricbeat.yml the logs goes to the specified location else not going, ie when started as servic… --- ## [Kibana , displaying of hosts takes a lot of time \[ I have only few hosts 6 max\]](https://discuss.elastic.co/t/kibana-displaying-of-hosts-takes-a-lot-of-time-i-have-only-few-hosts-6-max/206004)
**Author:** [@Joseph\_John](https://discuss.elastic.co/u/Joseph_John)\ **Replies:** 1\ **Last updated:** [November 13, 2019, 10:45am UTC](https://discuss.elastic.co/t/kibana-displaying-of-hosts-takes-a-lot-of-time-i-have-only-few-hosts-6-max/206004 "2019-11-13T10:45:54Z")
Hi All, My kibana interaces displays the status of the machines very very slow, I do not have much hosts, 6 hosts for tesing purpose and it is taking too much time to display, I have added the screen shot for reference … --- ## [Add Another Reputation Link into Kibana SIEM](https://discuss.elastic.co/t/add-another-reputation-link-into-kibana-siem/205072)
**Author:** [@joshuasmith](https://discuss.elastic.co/u/joshuasmith)\ **Replies:** 1\ **Last updated:** [November 13, 2019, 10:42am UTC](https://discuss.elastic.co/t/add-another-reputation-link-into-kibana-siem/205072 "2019-11-13T10:42:56Z")
Hello, We are starting to use the SIEM app some more and wanted to add a few additional links for Threat Intel and context. What is the process for getting another customizable link (similar to the virustotal or talosi… --- ## [Zeek dns logs show only as zeek.notice leaving dns fields empty](https://discuss.elastic.co/t/zeek-dns-logs-show-only-as-zeek-notice-leaving-dns-fields-empty/207633)
**Author:** [@Dimitry\_Baranov](https://discuss.elastic.co/u/Dimitry_Baranov)\ **Replies:** 0\ **Last updated:** [November 13, 2019, 6:34am UTC](https://discuss.elastic.co/t/zeek-dns-logs-show-only-as-zeek-notice-leaving-dns-fields-empty/207633 "2019-11-13T06:34:52Z")
Hello everyone, Filebeat Zeek Module -\> Logstash -\> ES -\> Kibana SIEM 7.4.0 setup showing zeek DNS, SSL etc logs only as zeek.notice logs (e.g. instead of zeek.dns.query there are only zeek.notice.query). All the mappin… --- ## [Autonomous System Number (ASN) not displaying](https://discuss.elastic.co/t/autonomous-system-number-asn-not-displaying/206195)
**Author:** [@Justin\_Doles](https://discuss.elastic.co/u/Justin_Doles)\ **Replies:** 3\ **Last updated:** [November 1, 2019, 7:58pm UTC](https://discuss.elastic.co/t/autonomous-system-number-asn-not-displaying/206195 "2019-11-01T19:58:09Z")
I have an index that I've created that follows the ECS standard. Within the index I have the source.as.\* and destination.as.\* fields that are populated using the GeoLite2ASN database. The fields are being populated in … --- ## [False Postive submission](https://discuss.elastic.co/t/false-postive-submission/205449)
**Author:** [@kman](https://discuss.elastic.co/u/kman)\ **Replies:** 2\ **Last updated:** [October 29, 2019, 7:08am UTC](https://discuss.elastic.co/t/false-postive-submission/205449 "2019-10-29T07:08:26Z")
Hi, our software is being detected by Endgame engine. we would like to remove the detection, could you guide me what needs to be done? thanks --- ## [Viewing Pinned Timeline Events](https://discuss.elastic.co/t/viewing-pinned-timeline-events/205132)
**Author:** [@MrTrav](https://discuss.elastic.co/u/MrTrav)\ **Replies:** 1\ **Last updated:** [October 25, 2019, 6:57am UTC](https://discuss.elastic.co/t/viewing-pinned-timeline-events/205132 "2019-10-25T06:57:53Z")
Is it possible to only view events which have been pinned (marked as persisted with the timeline)? --- ## [Bulk ingest of netflow and zeek logs into Elastic SIEM](https://discuss.elastic.co/t/bulk-ingest-of-netflow-and-zeek-logs-into-elastic-siem/204746)
**Author:** [@cks](https://discuss.elastic.co/u/cks)\ **Replies:** 1\ **Last updated:** [October 24, 2019, 3:07pm UTC](https://discuss.elastic.co/t/bulk-ingest-of-netflow-and-zeek-logs-into-elastic-siem/204746 "2019-10-24T15:07:17Z")
What would be best way to bulk ingest netflow and zeek logs into Elasticsearch, which I would like to access in SIEM in Kibana? I am looking to ingest several TBs of logs. I plan to bulk ingest other pcap, auth logs an… --- ## [Endpoint Introductions](https://discuss.elastic.co/t/endpoint-introductions/205093)
**Author:** [@Wadson](https://discuss.elastic.co/u/Wadson)\ **Replies:** 0\ **Last updated:** [October 24, 2019, 2:36pm UTC](https://discuss.elastic.co/t/endpoint-introductions/205093 "2019-10-24T14:36:53Z")
Welcome to Elastic Endpoint! I'm Wadson and I am on the Endpoint Implementation team here at Elastic on the East Coast. If you're new to Elastic Endpoint or have already purchased Endpoint please introduce yourself her… --- ## [New SIEM infrastructure with Elasticsearch](https://discuss.elastic.co/t/new-siem-infrastructure-with-elasticsearch/204559)
**Author:** [@elk2](https://discuss.elastic.co/u/elk2)\ **Replies:** 3\ **Last updated:** [October 22, 2019, 11:51pm UTC](https://discuss.elastic.co/t/new-siem-infrastructure-with-elasticsearch/204559 "2019-10-22T23:51:57Z")
I want to implement a new SIEM infrastructure for threat detection and incident response. I would host the systems in our datacenter where all others servers are hosted. I want to use beat to send logs from servers to … --- ## [Problem with SIEM](https://discuss.elastic.co/t/problem-with-siem/204593)
**Author:** [@Aleix\_Abrie\_Prat](https://discuss.elastic.co/u/Aleix_Abrie_Prat)\ **Replies:** 7\ **Last updated:** [October 22, 2019, 4:52pm UTC](https://discuss.elastic.co/t/problem-with-siem/204593 "2019-10-22T16:52:42Z")
Hello everyone, I have a problem once i have configured SIEM and auditbeat on the "client" machine. I configured one machine only with auditbeat and the coniguration standars. I will post below the configuration. The … --- ## [For example, I have machine A running as a Server and I would like to manage other clients such as machine B, C, D,...etc So, how to do that? How to get many hosts?](https://discuss.elastic.co/t/for-example-i-have-machine-a-running-as-a-server-and-i-would-like-to-manage-other-clients-such-as-machine-b-c-d-etc-so-how-to-do-that-how-to-get-many-hosts/201330)
**Author:** [@pbona](https://discuss.elastic.co/u/pbona)\ **Replies:** 20\ **Last updated:** [October 22, 2019, 12:44am UTC](https://discuss.elastic.co/t/for-example-i-have-machine-a-running-as-a-server-and-i-would-like-to-manage-other-clients-such-as-machine-b-c-d-etc-so-how-to-do-that-how-to-get-many-hosts/201330 "2019-10-22T00:44:10Z")
--- ## [How to change query in SIEM](https://discuss.elastic.co/t/how-to-change-query-in-siem/204113)
**Author:** [@tatdat](https://discuss.elastic.co/u/tatdat)\ **Replies:** 2\ **Last updated:** [October 21, 2019, 2:32am UTC](https://discuss.elastic.co/t/how-to-change-query-in-siem/204113 "2019-10-21T02:32:36Z")
Im using Elastic stack 7.4 and stup auditbeat, filebeat, packetbeat ready. Im focus on SIEM -\> network, in Top DNS domains panel, i saw , default get top root domain not real domain. ( dns.question.registered\_domain ins… --- ## [SIEM not detecting ASA success failure logins](https://discuss.elastic.co/t/siem-not-detecting-asa-success-failure-logins/203754)
**Author:** [@mancharagopan](https://discuss.elastic.co/u/mancharagopan)\ **Replies:** 5\ **Last updated:** [October 19, 2019, 5:31am UTC](https://discuss.elastic.co/t/siem-not-detecting-asa-success-failure-logins/203754 "2019-10-19T05:31:59Z")
SIEM not detecting success and failure logins from ASA syslog messages. and also it detect filebeat hostname as the host in SIEM app. What can i do? ASA Syslog message parsing could be better from filebeat 7.4 to popula… --- ## [Active Directory logs and mapping to ECS (I am stumped)](https://discuss.elastic.co/t/active-directory-logs-and-mapping-to-ecs-i-am-stumped/203321)
**Author:** [@iukea](https://discuss.elastic.co/u/iukea)\ **Replies:** 6\ **Last updated:** [October 14, 2019, 5:18pm UTC](https://discuss.elastic.co/t/active-directory-logs-and-mapping-to-ecs-i-am-stumped/203321 "2019-10-14T17:18:12Z")
Hello guys/girls, Need some words of wisdom on ECS and on Active Directory logs. I am currently logging a Windows server 2012 Domain controller and used to flowing guide (provided by ElasticSearch) - https://www.elast… --- ## [SIEM Command Line Auditing 4688 - 4689](https://discuss.elastic.co/t/siem-command-line-auditing-4688-4689/202656)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 10\ **Last updated:** [October 14, 2019, 1:01pm UTC](https://discuss.elastic.co/t/siem-command-line-auditing-4688-4689/202656 "2019-10-14T13:01:09Z")
Hello, 2 of the most interesting event id's in siem are 4688 and 4689, which can be enabled with a gpo and enable us to monitor every command used in your network. Interesting fields are: winlog.event\_data.NewProcessN… --- ## [How to get more hosts in SIEM (Auditbeat)](https://discuss.elastic.co/t/how-to-get-more-hosts-in-siem-auditbeat/201904)
**Author:** [@pbona](https://discuss.elastic.co/u/pbona)\ **Replies:** 1\ **Last updated:** [October 2, 2019, 11:45am UTC](https://discuss.elastic.co/t/how-to-get-more-hosts-in-siem-auditbeat/201904 "2019-10-02T11:45:39Z")
[Previous page](https://discuss.elastic.co/c/security/83.md?page=64) [Next page](https://discuss.elastic.co/c/security/83.md?page=66)