# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=66 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 67 --- ## [Defenxor DSIEM for Event Correlation with Logstash](https://discuss.elastic.co/t/defenxor-dsiem-for-event-correlation-with-logstash/201649)
**Author:** [@gargantua](https://discuss.elastic.co/u/gargantua)\ **Replies:** 0\ **Last updated:** [September 30, 2019, 1:47pm UTC](https://discuss.elastic.co/t/defenxor-dsiem-for-event-correlation-with-logstash/201649 "2019-09-30T13:47:04Z")
Hello, I want to correlate my events with defenxor/dsiem. Is there anyone who uses dsiem for event correlation? Is it enough for correlation? What are advantages and disadvantages of dsiem? --- ## [SIEM Infrastructure design](https://discuss.elastic.co/t/siem-infrastructure-design/201529)
**Author:** [@lokmanopt](https://discuss.elastic.co/u/lokmanopt)\ **Replies:** 1\ **Last updated:** [September 30, 2019, 10:35am UTC](https://discuss.elastic.co/t/siem-infrastructure-design/201529 "2019-09-30T10:35:24Z")
Dear Concern, I want to implement SIEM solution for production. I need to ELK expert's help Please share Design for production environment. I have more then 300 system and 300 router as well as 6 Cisco firewall. So p… --- ## [Filter Uncommon Host Processes](https://discuss.elastic.co/t/filter-uncommon-host-processes/197874)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 2\ **Last updated:** [September 27, 2019, 11:05am UTC](https://discuss.elastic.co/t/filter-uncommon-host-processes/197874 "2019-09-27T11:05:11Z")
Hello, Read here (https://discuss.elastic.co/t/uncommon-processes/190115) that the Uncommon Processes query is an aggregation on process.name sorted by host cardinality first (cardinality of host.name where this pro… --- ## [Hash used in Elastic?](https://discuss.elastic.co/t/hash-used-in-elastic/201326)
**Author:** [@zeno](https://discuss.elastic.co/u/zeno)\ **Replies:** 2\ **Last updated:** [September 27, 2019, 10:49am UTC](https://discuss.elastic.co/t/hash-used-in-elastic/201326 "2019-09-27T10:49:08Z")
Hi so i am studying and using Kibana open source and wanted to know whether kibana open source by default creates hashes of files ? The document of elastic says that it does use SHA256, SHA-1 & MD5 but as per the auditbe… --- ## [SIEM ECS descriptions taking huge amount of unneccesary space in SIEM](https://discuss.elastic.co/t/siem-ecs-descriptions-taking-huge-amount-of-unneccesary-space-in-siem/200972)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [September 27, 2019, 10:27am UTC](https://discuss.elastic.co/t/siem-ecs-descriptions-taking-huge-amount-of-unneccesary-space-in-siem/200972 "2019-09-27T10:27:59Z")
Hello, Just some constructive feedback. When data is added to a SIEM timeline and the results are analyzed, it seems every field has a description column, which imho takes a huge amount of space, which could be used for… --- ## [How many swap files are created when you update a text file](https://discuss.elastic.co/t/how-many-swap-files-are-created-when-you-update-a-text-file/197625)
**Author:** [@zeno](https://discuss.elastic.co/u/zeno)\ **Replies:** 8\ **Last updated:** [September 26, 2019, 7:16am UTC](https://discuss.elastic.co/t/how-many-swap-files-are-created-when-you-update-a-text-file/197625 "2019-09-26T07:16:18Z")
I want to know how many swap files are created in kibana for Ubuntu server when you create a text file using nano. i see 4 swap files deleted when i deleted the text file i have created in Ubuntu. Similarly the no of swa… --- ## [Add additional data source to SIEM dashboard](https://discuss.elastic.co/t/add-additional-data-source-to-siem-dashboard/199712)
**Author:** [@Justin\_Doles](https://discuss.elastic.co/u/Justin_Doles)\ **Replies:** 3\ **Last updated:** [September 18, 2019, 8:46am UTC](https://discuss.elastic.co/t/add-additional-data-source-to-siem-dashboard/199712 "2019-09-18T08:46:35Z")
Is there a way to add additional data sources to the SIEM dashboard? I have an index, syslog-, that collects data from our network switches & firewalls. It does use the ECS conventions. The dashboard seems to only use… --- ## [Hosts tab in SIEM and WEF](https://discuss.elastic.co/t/hosts-tab-in-siem-and-wef/190162)
**Author:** [@smerzlyakov](https://discuss.elastic.co/u/smerzlyakov)\ **Replies:** 16\ **Last updated:** [September 16, 2019, 2:25pm UTC](https://discuss.elastic.co/t/hosts-tab-in-siem-and-wef/190162 "2019-09-16T14:25:58Z")
There is Hosts tab in SIEM. I think nobody in Enterprise uses Winlogbeat on every Windows hosts. It is standard to use collector for logs and send Logs using Windows Event Forwarding on it. So, in field Host it will be n… --- ## [SonicWall Firewall and SIEM or SNMP](https://discuss.elastic.co/t/sonicwall-firewall-and-siem-or-snmp/199546)
**Author:** [@jabalo1327](https://discuss.elastic.co/u/jabalo1327)\ **Replies:** 1\ **Last updated:** [September 15, 2019, 5:49pm UTC](https://discuss.elastic.co/t/sonicwall-firewall-and-siem-or-snmp/199546 "2019-09-15T17:49:30Z")
How Do I configure my sonicwall firewall to send all the logs to the cloud for this product and what product Do I actually need? Is there any approximate price range for month? I will like to see all the data that my s… --- ## [Envoyproxy](https://discuss.elastic.co/t/envoyproxy/195755)
**Author:** [@mcapua](https://discuss.elastic.co/u/mcapua)\ **Replies:** 2\ **Last updated:** [September 7, 2019, 7:18am UTC](https://discuss.elastic.co/t/envoyproxy/195755 "2019-09-07T07:18:28Z")
Hello, I'm trying to send envoyproxy logs to SIEM but I'm receiving a WARN message. ISTIO was configured with stdout access logs and running on Kubernetes \> Finished:false, Fileinfo:(\*os.fileStat)(0xc0035c2ea0), Sourc… --- ## [Fielddata error preventing Authentications tab populating](https://discuss.elastic.co/t/fielddata-error-preventing-authentications-tab-populating/197337)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 3\ **Last updated:** [September 4, 2019, 3:41am UTC](https://discuss.elastic.co/t/fielddata-error-preventing-authentications-tab-populating/197337 "2019-09-04T03:41:04Z")
Hi all, I'm using Filebeat 7.3.1 with Elastic Cloud 7.3.0 and the Authentications pane (in SIEM app) is empty (despite being able to view them in Discover / filebeat index. When I inspect the response in the SIEM app I… --- ## [PoC - Use ELK to aggregate multiple LogInsight Systems into one SOC](https://discuss.elastic.co/t/poc-use-elk-to-aggregate-multiple-loginsight-systems-into-one-soc/196615)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 2\ **Last updated:** [September 3, 2019, 11:45am UTC](https://discuss.elastic.co/t/poc-use-elk-to-aggregate-multiple-loginsight-systems-into-one-soc/196615 "2019-09-03T11:45:16Z")
I've personally in the last 3-4 years been using Grafana+ELK for Log&Metric monitoring in running a large application platform, but have now changed internally to a position in Security & Operation Automation and are her… --- ## [Siem on logstash and filebeat](https://discuss.elastic.co/t/siem-on-logstash-and-filebeat/196523)
**Author:** [@Vikash\_Singh1](https://discuss.elastic.co/u/Vikash_Singh1)\ **Replies:** 1\ **Last updated:** [August 30, 2019, 12:49pm UTC](https://discuss.elastic.co/t/siem-on-logstash-and-filebeat/196523 "2019-08-30T12:49:21Z")
Hi..I am sending netflow data to my server via filebeat and the indices are successfully created as well as its implemented on siem too. But there are many information which are unavailable like geo location, protocols n… --- ## [Event Correlation on ELK](https://discuss.elastic.co/t/event-correlation-on-elk/194362)
**Author:** [@alperensoydan](https://discuss.elastic.co/u/alperensoydan)\ **Replies:** 2\ **Last updated:** [August 26, 2019, 12:07pm UTC](https://discuss.elastic.co/t/event-correlation-on-elk/194362 "2019-08-26T12:07:08Z")
Hello, I installed ELK as a SIEM and It works nicely. There is only one problem is that correlation of different events and it does not come default within ELK. According to my researches, Logstash filters work for this… --- ## [GraphQL internal error](https://discuss.elastic.co/t/graphql-internal-error/195405)
**Author:** [@j13029](https://discuss.elastic.co/u/j13029)\ **Replies:** 1\ **Last updated:** [August 19, 2019, 10:24am UTC](https://discuss.elastic.co/t/graphql-internal-error/195405 "2019-08-19T10:24:20Z")
I am currently getting some error messages under SIEM menus. "Unable to parse JSON \< at line 52" Checking the network logs, this call seems to be failing along. It would sometimes go through and sometimes fail. What c… --- ## [Difference between source/destination and server/client](https://discuss.elastic.co/t/difference-between-source-destination-and-server-client/195075)
**Author:** [@vbr](https://discuss.elastic.co/u/vbr)\ **Replies:** 1\ **Last updated:** [August 16, 2019, 1:48pm UTC](https://discuss.elastic.co/t/difference-between-source-destination-and-server-client/195075 "2019-08-16T13:48:35Z")
Hi. I'm currently evaluating the SIEM app for integration in our security workflows, and converting most of our datasets to ECS for that purpose. I'm puzzled by the existence of both client/server and source/destination… --- ## [I'm not seeing any geoip data from my zeek logs in my SIEM map](https://discuss.elastic.co/t/im-not-seeing-any-geoip-data-from-my-zeek-logs-in-my-siem-map/194677)
**Author:** [@dpangallo](https://discuss.elastic.co/u/dpangallo)\ **Replies:** 2\ **Last updated:** [August 12, 2019, 5:09pm UTC](https://discuss.elastic.co/t/im-not-seeing-any-geoip-data-from-my-zeek-logs-in-my-siem-map/194677 "2019-08-12T17:09:08Z")
I'm using Filebeats 7.3.0 to ingest Zeek network logs into Elasticsearch 7.3.0, but I'm not seeing any geoip fields created in my indexes. The Zeek ingest module automatically created pipelines for each of the different… --- ## [Filebeat for Sophos XG Firewall](https://discuss.elastic.co/t/filebeat-for-sophos-xg-firewall/192952)
**Author:** [@kal1s](https://discuss.elastic.co/u/kal1s)\ **Replies:** 8\ **Last updated:** [August 7, 2019, 4:15pm UTC](https://discuss.elastic.co/t/filebeat-for-sophos-xg-firewall/192952 "2019-08-07T16:15:41Z")
Hi, Will be possible to have Filebeat for Sophos XG FIrewall and integrated with Elastic SIEM like Filebeat Cisco? Best Regards, Ricardo Calimanis --- ## [Why don't sudo events from auth.log have an event.category/event.action?](https://discuss.elastic.co/t/why-dont-sudo-events-from-auth-log-have-an-event-category-event-action/193911)
**Author:** [@agx](https://discuss.elastic.co/u/agx)\ **Replies:** 1\ **Last updated:** [August 7, 2019, 11:10am UTC](https://discuss.elastic.co/t/why-dont-sudo-events-from-auth-log-have-an-event-category-event-action/193911 "2019-08-07T11:10:21Z")
Hello, I've been exploring the new SIEM features in 7.3 and am pretty excited about promoting ECS at work. I noticed that when ingesting my auth logs from Ubuntu 18.04 using the system module included with filebeat, th… --- ## [SIEM Hosts/All Hosts Tables Empty](https://discuss.elastic.co/t/siem-hosts-all-hosts-tables-empty/189832)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 11\ **Last updated:** [August 5, 2019, 1:03pm UTC](https://discuss.elastic.co/t/siem-hosts-all-hosts-tables-empty/189832 "2019-08-05T13:03:12Z")
Started playing with SIEM after upgrading our Stack and some agents to 7.2. I currently have winlogbeat and auditbeat sending data to our stack. Auditbeat has the host and process modules enabled, winlogbeat is sending… --- ## [Watcher alert, ssh auth](https://discuss.elastic.co/t/watcher-alert-ssh-auth/191969)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 1\ **Last updated:** [July 31, 2019, 6:27am UTC](https://discuss.elastic.co/t/watcher-alert-ssh-auth/191969 "2019-07-31T06:27:54Z")
hey there, i'm new using elastic and i just wanna asking about alerting. i make an alert through email. but i don't know how the user id showed up at body email and the count the user try. btw this for ssh auth. thanks --- ## [Empty DNS Fields and Tables in Network View](https://discuss.elastic.co/t/empty-dns-fields-and-tables-in-network-view/192285)
**Author:** [@pepperhat](https://discuss.elastic.co/u/pepperhat)\ **Replies:** 1\ **Last updated:** [July 30, 2019, 8:21am UTC](https://discuss.elastic.co/t/empty-dns-fields-and-tables-in-network-view/192285 "2019-07-30T08:21:02Z")
I have working with the new SIEM module in 7.2 and have been consuming Suricata data with the filebeat module. When reviewing the data in the SIEM view, some fields and tables are empty, where I would expect data to show… --- ## [Having SIEM read windows events from non-default index pattern](https://discuss.elastic.co/t/having-siem-read-windows-events-from-non-default-index-pattern/192496)
**Author:** [@tyler\_hilsabeck](https://discuss.elastic.co/u/tyler_hilsabeck)\ **Replies:** 2\ **Last updated:** [July 29, 2019, 12:47pm UTC](https://discuss.elastic.co/t/having-siem-read-windows-events-from-non-default-index-pattern/192496 "2019-07-29T12:47:19Z")
Hi Everyone, I do not store my winlogbeat data in the default named indexes (winlogbeat-\*) but rather windows\_logs-\* for ease of management with ILM, log type clarity, etc. I have installed the default kibana dashboard… --- ## [Zeek DNS Logs Into Top DNS Domains Section](https://discuss.elastic.co/t/zeek-dns-logs-into-top-dns-domains-section/191888)
**Author:** [@MrTrav](https://discuss.elastic.co/u/MrTrav)\ **Replies:** 1\ **Last updated:** [July 29, 2019, 10:35am UTC](https://discuss.elastic.co/t/zeek-dns-logs-into-top-dns-domains-section/191888 "2019-07-29T10:35:29Z")
Is there a way to get the data from the Zeek DNS logs into the Top DNS Domains panel in the SIEM? --- ## [Inserting Custom Logs Into Siem](https://discuss.elastic.co/t/inserting-custom-logs-into-siem/190093)
**Author:** [@MrTrav](https://discuss.elastic.co/u/MrTrav)\ **Replies:** 3\ **Last updated:** [July 23, 2019, 11:00am UTC](https://discuss.elastic.co/t/inserting-custom-logs-into-siem/190093 "2019-07-23T11:00:12Z")
I am trying to understand the fields necessary to populate custom logs into the SIEM. I have the ability to use ECS and get logs to show up, however the hosts they are coming from are not populating the "Hosts" section.… --- ## [SIEM Zeek log data getting Error decoding JSON](https://discuss.elastic.co/t/siem-zeek-log-data-getting-error-decoding-json/191103)
**Author:** [@dpangallo](https://discuss.elastic.co/u/dpangallo)\ **Replies:** 3\ **Last updated:** [July 18, 2019, 7:13pm UTC](https://discuss.elastic.co/t/siem-zeek-log-data-getting-error-decoding-json/191103 "2019-07-18T19:13:31Z")
I'm trying to ingest Zeek network log data (formerly Bro) into SIEM (Beta 7.2). Finally got it configured to ingest the data but I'm getting tons of errors decoding JSON. Here's a sample: ERROR#011readjson/json.go:52#01… --- ## [FortiAnalyzer logs to SIEM](https://discuss.elastic.co/t/fortianalyzer-logs-to-siem/190801)
**Author:** [@gabrieltavares\_pp](https://discuss.elastic.co/u/gabrieltavares_pp)\ **Replies:** 1\ **Last updated:** [July 18, 2019, 2:48pm UTC](https://discuss.elastic.co/t/fortianalyzer-logs-to-siem/190801 "2019-07-18T14:48:52Z")
Hello, I'm new with ELK and I installed Elasticsearch, Kibana and Logstash in the same server. I followed this procedure to send logs from FortiAnalyzer to ELK. I tried to send logs to SIEM, but I have to setup Beats … --- ## [Failed Logins](https://discuss.elastic.co/t/failed-logins/190118)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 3\ **Last updated:** [July 17, 2019, 10:47pm UTC](https://discuss.elastic.co/t/failed-logins/190118 "2019-07-17T22:47:50Z")
How are failed logins tracked? I have lots of winlog.event\_id: 4771 indicating a login failure, but if I look at SIEM, it shows thousands of successful logins and 0 failed logins. --- ## [SOAR for Elastic Capabilities](https://discuss.elastic.co/t/soar-for-elastic-capabilities/190800)
**Author:** [@Joseph\_Loomis](https://discuss.elastic.co/u/Joseph_Loomis)\ **Replies:** 1\ **Last updated:** [July 17, 2019, 4:39pm UTC](https://discuss.elastic.co/t/soar-for-elastic-capabilities/190800 "2019-07-17T16:39:58Z")
Does anyone know if Elastic is going to see more SOAR capabilities natively inside of the SIEM like Phantom and others are doing? --- ## [SIEM Elastic - Beta -7.2 - Cisco module - unable to see data](https://discuss.elastic.co/t/siem-elastic-beta-7-2-cisco-module-unable-to-see-data/187546)
**Author:** [@Mons](https://discuss.elastic.co/u/Mons)\ **Replies:** 2\ **Last updated:** [July 17, 2019, 1:51am UTC](https://discuss.elastic.co/t/siem-elastic-beta-7-2-cisco-module-unable-to-see-data/187546 "2019-07-17T01:51:58Z")
Hi All, I am trying my hands on SIEM elastic module. Wanted to configure Cisco network device’s logs using add data option under SIEM. Followed the steps under RPM. Have enabled the filebeat module for cisco as well. B… [Previous page](https://discuss.elastic.co/c/security/83.md?page=65) [Next page](https://discuss.elastic.co/c/security/83.md?page=67)