# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=67 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 68 --- ## [Auditbeat file integrity monitoring does not show user who made changes to file](https://discuss.elastic.co/t/auditbeat-file-integrity-monitoring-does-not-show-user-who-made-changes-to-file/188568)
**Author:** [@EMMANUEL\_CHIBUOGWU](https://discuss.elastic.co/u/EMMANUEL_CHIBUOGWU)\ **Replies:** 4\ **Last updated:** [July 16, 2019, 8:20am UTC](https://discuss.elastic.co/t/auditbeat-file-integrity-monitoring-does-not-show-user-who-made-changes-to-file/188568 "2019-07-16T08:20:29Z")
How can i see the user who made changes, created or deleted a file. The user who --- ## [Elastic SIEM integration with Ansible for Security Automation](https://discuss.elastic.co/t/elastic-siem-integration-with-ansible-for-security-automation/188915)
**Author:** [@imran](https://discuss.elastic.co/u/imran)\ **Replies:** 3\ **Last updated:** [July 15, 2019, 1:53pm UTC](https://discuss.elastic.co/t/elastic-siem-integration-with-ansible-for-security-automation/188915 "2019-07-15T13:53:09Z")
Hi, I wanted to know if there is a possibility where in Ansible can be integrated with the elastic SIEM app to take some automated actions against security events so that we can build a custom SOAR functionality rather … --- ## [Uncommon Processes](https://discuss.elastic.co/t/uncommon-processes/190115)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 1\ **Last updated:** [July 15, 2019, 7:55am UTC](https://discuss.elastic.co/t/uncommon-processes/190115 "2019-07-15T07:55:06Z")
How does SIEM determine what is and is not an uncommon process? --- ## [Drilling into Suricata data](https://discuss.elastic.co/t/drilling-into-suricata-data/189629)
**Author:** [@sstover](https://discuss.elastic.co/u/sstover)\ **Replies:** 4\ **Last updated:** [July 11, 2019, 6:46pm UTC](https://discuss.elastic.co/t/drilling-into-suricata-data/189629 "2019-07-11T18:46:31Z")
We're a Suricata shop and I was hoping to use the SIEM to crossreference things like (external) IP reputation with Suricata events using the SIEM. Starting out slowly, before jumping into anything like external reputati… --- ## [Last Seen timestamp under Hosts section appears to be incorrect](https://discuss.elastic.co/t/last-seen-timestamp-under-hosts-section-appears-to-be-incorrect/189769)
**Author:** [@redrise](https://discuss.elastic.co/u/redrise)\ **Replies:** 2\ **Last updated:** [July 11, 2019, 7:06am UTC](https://discuss.elastic.co/t/last-seen-timestamp-under-hosts-section-appears-to-be-incorrect/189769 "2019-07-11T07:06:31Z")
I've just been trying the new SIEM stuff out and i fired a load of data in from auditbeat, filebeat, and packetbeat on a CentOS 7 box. When I looked at the Hosts section in the SIEM part of Kibana I noticed the value fo… --- ## [Trouble with Index Patterns](https://discuss.elastic.co/t/trouble-with-index-patterns/188981)
**Author:** [@mindorod](https://discuss.elastic.co/u/mindorod)\ **Replies:** 12\ **Last updated:** [July 5, 2019, 2:33pm UTC](https://discuss.elastic.co/t/trouble-with-index-patterns/188981 "2019-07-05T14:33:01Z")
Hi - Having a bit of trouble with the SIEM + beats configuration regarding index mappings. I've stood up 7.2 with the latest beats and followed the documentation to the T. When I open the SIEM app, I can see most of my d… --- ## [Configuring SIEM](https://discuss.elastic.co/t/configuring-siem/187793)
**Author:** [@clem1](https://discuss.elastic.co/u/clem1)\ **Replies:** 2\ **Last updated:** [July 5, 2019, 11:15am UTC](https://discuss.elastic.co/t/configuring-siem/187793 "2019-07-05T11:15:00Z")
Hello all, I have been playing with ELK for a month now, and I want to setup alerting rules based on failed attempts or so. For now, I have only found ElastAlert on github. Recently, I heard that there is a new functio… --- ## [Netflow data ingested but not showing under SIEM | Network](https://discuss.elastic.co/t/netflow-data-ingested-but-not-showing-under-siem-network/188897)
**Author:** [@involuntary-pretzel](https://discuss.elastic.co/u/involuntary-pretzel)\ **Replies:** 2\ **Last updated:** [July 4, 2019, 12:30pm UTC](https://discuss.elastic.co/t/netflow-data-ingested-but-not-showing-under-siem-network/188897 "2019-07-04T12:30:35Z")
Hi I have a fresh install of logstash 7.2 with netflow configure following the /home/tutorial/netflow tutorial, and its pushing data to elastic.cloud (7.2) sucessfully. The Dashboard Netflow: Overview work great and no … --- ## [Role to provide access to SIEM?](https://discuss.elastic.co/t/role-to-provide-access-to-siem/188629)
**Author:** [@kmohd](https://discuss.elastic.co/u/kmohd)\ **Replies:** 2\ **Last updated:** [July 4, 2019, 4:11am UTC](https://discuss.elastic.co/t/role-to-provide-access-to-siem/188629 "2019-07-04T04:11:49Z")
Is there any role to provide read only access to SIEM? Its working for superusers however i cannot find a specific role just for that. --- ## [SIEM not ingesting Windows logs from servers](https://discuss.elastic.co/t/siem-not-ingesting-windows-logs-from-servers/188653)
**Author:** [@sc1](https://discuss.elastic.co/u/sc1)\ **Replies:** 7\ **Last updated:** [July 3, 2019, 1:48pm UTC](https://discuss.elastic.co/t/siem-not-ingesting-windows-logs-from-servers/188653 "2019-07-03T13:48:36Z")
Hello, I've been testing the new SIEM function, I've got 2 domain controllers/servers sending through logs via Winlogbeat and 4 client PCs sending logs again through the same method. When I check via dashboards or even … --- ## [Inserting Logs into SIEM](https://discuss.elastic.co/t/inserting-logs-into-siem/188510)
**Author:** [@inteli](https://discuss.elastic.co/u/inteli)\ **Replies:** 2\ **Last updated:** [July 3, 2019, 11:17am UTC](https://discuss.elastic.co/t/inserting-logs-into-siem/188510 "2019-07-03T11:17:14Z")
Hi Guys, the new elastic SIEM timeline feature looks amazing and I would like to use it for log analysis. Unfortunately I don't have that much experience regarding ELK setup. If i understand correctly it is only possi… --- ## [SIEM Parsing](https://discuss.elastic.co/t/siem-parsing/188291)
**Author:** [@pinguin](https://discuss.elastic.co/u/pinguin)\ **Replies:** 1\ **Last updated:** [July 1, 2019, 9:34pm UTC](https://discuss.elastic.co/t/siem-parsing/188291 "2019-07-01T21:34:28Z")
we are trying to send windows event logs using winlogbeat 7.XX version , we are creating severals of dashboards based on the correlation rules of event built on top of event ,sysmon and security logs ex : event.id =1 AND… --- ## [Host.hostname field bug](https://discuss.elastic.co/t/host-hostname-field-bug/188219)
**Author:** [@Chinedum\_Nwuzor](https://discuss.elastic.co/u/Chinedum_Nwuzor)\ **Replies:** 6\ **Last updated:** [July 1, 2019, 3:55pm UTC](https://discuss.elastic.co/t/host-hostname-field-bug/188219 "2019-07-01T15:55:44Z")
Can anyone please help resolve this? --- ## [Lists](https://discuss.elastic.co/t/lists/188163)
**Author:** [@anon15412260](https://discuss.elastic.co/u/anon15412260)\ **Replies:** 1\ **Last updated:** [July 1, 2019, 10:30am UTC](https://discuss.elastic.co/t/lists/188163 "2019-07-01T10:30:19Z")
Would be neat if this SIEM module allowed for users to build out lists to add/remove/modify entries so easily query and alert on items. For instance when searching, users could add users/ips/urls to a known bad list for … [Previous page](https://discuss.elastic.co/c/security/83.md?page=66)