# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=7 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 8 --- ## [Question related to ESA-2025-06 (security advisory)](https://discuss.elastic.co/t/question-related-to-esa-2025-06-security-advisory/375521)
**Author:** [@Tears](https://discuss.elastic.co/u/Tears)\ **Replies:** 1\ **Last updated:** [March 7, 2025, 2:26am UTC](https://discuss.elastic.co/t/question-related-to-esa-2025-06-security-advisory/375521 "2025-03-07T02:26:14Z")
Hello, ESA-2025-06 is a security advisory about a prototype pollution vulnerability. This avisory references the following CVE ID : CVE-2025-25012 Unless I'm mistaken, there is a different CVE ID in the mitre API for t… --- ## [Is it possible to disable elastic defend ransomware canary?](https://discuss.elastic.co/t/is-it-possible-to-disable-elastic-defend-ransomware-canary/375481)
**Author:** [@bobr](https://discuss.elastic.co/u/bobr)\ **Replies:** 2\ **Last updated:** [March 6, 2025, 4:23pm UTC](https://discuss.elastic.co/t/is-it-possible-to-disable-elastic-defend-ransomware-canary/375481 "2025-03-06T16:23:50Z")
We have tried setting 'windows.advanced.ransomware.canary' to false but shortly after a new Windows workstation agent is enrolled we are still seeing the pair of canary directories created. We do not have a 'Platinum' ac… --- ## [On demand scan on Linux host](https://discuss.elastic.co/t/on-demand-scan-on-linux-host/375508)
**Author:** [@Charles\_Nkuna](https://discuss.elastic.co/u/Charles_Nkuna)\ **Replies:** 1\ **Last updated:** [March 6, 2025, 2:07pm UTC](https://discuss.elastic.co/t/on-demand-scan-on-linux-host/375508 "2025-03-06T14:07:15Z")
Hello, I'm trying to perform the on demand scan on Linux hosts without a success . is this possible ? if so whats the command associate with it ? Thanks --- ## [Create new Event Renderers](https://discuss.elastic.co/t/create-new-event-renderers/375137)
**Author:** [@lduvnjak](https://discuss.elastic.co/u/lduvnjak)\ **Replies:** 1\ **Last updated:** [March 6, 2025, 8:08am UTC](https://discuss.elastic.co/t/create-new-event-renderers/375137 "2025-03-06T08:08:09Z")
This is basically a copy from an existing, old discuss topic. Is there any progress on allowing us to modify or create our own event renders? The original topic: Is there an issue on github for this Feature Request t… --- ## [How to Trigger Spike in Remote File Transfers](https://discuss.elastic.co/t/how-to-trigger-spike-in-remote-file-transfers/375415)
**Author:** [@warren.cruz](https://discuss.elastic.co/u/warren.cruz)\ **Replies:** 0\ **Last updated:** [March 5, 2025, 12:57am UTC](https://discuss.elastic.co/t/how-to-trigger-spike-in-remote-file-transfers/375415 "2025-03-05T00:57:02Z")
Good day. I'd like to ask about how to get a hit on Spike in Remote File Transfers for testing purposes. I saw the high\_count function being used. Is there a definite number of events that will do the trick? I made a … --- ## [After upgrading Elastic SIEM to version 8.17.2 a lot security alerts are not being displayed.](https://discuss.elastic.co/t/after-upgrading-elastic-siem-to-version-8-17-2-a-lot-security-alerts-are-not-being-displayed/375145)
**Author:** [@nma2025](https://discuss.elastic.co/u/nma2025)\ **Replies:** 0\ **Last updated:** [February 27, 2025, 10:09am UTC](https://discuss.elastic.co/t/after-upgrading-elastic-siem-to-version-8-17-2-a-lot-security-alerts-are-not-being-displayed/375145 "2025-02-27T10:09:13Z")
After upgrading Elastic SIEM to version 8.17.2, some security alerts, such as low-severity alerts, can be verified within their respective detection rules but do not appear in the alert view. --- ## [What steps are required to analyze a small PCAP file in Elastic Machine Learning Anomaly Detection? When I saved the PCAP file as a CSV, the data was not suitable for analysis with anomaly detection, even though it is only 95 KB](https://discuss.elastic.co/t/what-steps-are-required-to-analyze-a-small-pcap-file-in-elastic-machine-learning-anomaly-detection-when-i-saved-the-pcap-file-as-a-csv-the-data-was-not-suitable-for-analysis-with-anomaly-detection-even-though-it-is-only-95-kb/374530)
**Author:** [@Illya\_Bjazevic](https://discuss.elastic.co/u/Illya_Bjazevic)\ **Replies:** 4\ **Last updated:** [February 21, 2025, 7:57pm UTC](https://discuss.elastic.co/t/what-steps-are-required-to-analyze-a-small-pcap-file-in-elastic-machine-learning-anomaly-detection-when-i-saved-the-pcap-file-as-a-csv-the-data-was-not-suitable-for-analysis-with-anomaly-detection-even-though-it-is-only-95-kb/374530 "2025-02-21T19:57:47Z")
What steps are required to analyze a small PCAP file in Elastic Machine Learning Anomaly Detection? When I saved the PCAP file as a CSV, the data was not suitable for analysis with anomaly detection, even though it is on… --- ## [How to extend Elastic Agent ability?](https://discuss.elastic.co/t/how-to-extend-elastic-agent-ability/374788)
**Author:** [@wangshifeng](https://discuss.elastic.co/u/wangshifeng)\ **Replies:** 0\ **Last updated:** [February 20, 2025, 3:38am UTC](https://discuss.elastic.co/t/how-to-extend-elastic-agent-ability/374788 "2025-02-20T03:38:33Z")
I'm trying to extend the functionality of Elastic Agent and I have the following questions: If I create an Integration and upload this package to Kibana, is this a feature available only in the commercial version, or … --- ## [Sysmon registry logs don't get to elastic](https://discuss.elastic.co/t/sysmon-registry-logs-dont-get-to-elastic/374772)
**Author:** [@pok\_lehbim](https://discuss.elastic.co/u/pok_lehbim)\ **Replies:** 0\ **Last updated:** [February 19, 2025, 1:53pm UTC](https://discuss.elastic.co/t/sysmon-registry-logs-dont-get-to-elastic/374772 "2025-02-19T13:53:36Z")
I'm trying to set up the detection rule called "Privilege Escalation via Windir Environment Variable" but the data that this rule relies upon isn't getting to elastic. I've made sure to have everything set up correctly, … --- ## [The audit log integration process.args log entry only contains the user.id field; it does not contain the user.name field. Please suggest!It's urgent!](https://discuss.elastic.co/t/the-audit-log-integration-process-args-log-entry-only-contains-the-user-id-field-it-does-not-contain-the-user-name-field-please-suggest-its-urgent/374400)
**Author:** [@evangelin](https://discuss.elastic.co/u/evangelin)\ **Replies:** 8\ **Last updated:** [February 19, 2025, 7:37am UTC](https://discuss.elastic.co/t/the-audit-log-integration-process-args-log-entry-only-contains-the-user-id-field-it-does-not-contain-the-user-name-field-please-suggest-its-urgent/374400 "2025-02-19T07:37:15Z")
Hello Team, I'm using the audit integration to parse audit logs. For the audit record type USER\_CMD, the user.name field is not being mapped; only the user.id is present. The log entry contains AUID, which represents t… --- ## [How to reduce false/positives for prebuilt Windows Security ML jobs?](https://discuss.elastic.co/t/how-to-reduce-false-positives-for-prebuilt-windows-security-ml-jobs/374532)
**Author:** [@Rorb](https://discuss.elastic.co/u/Rorb)\ **Replies:** 0\ **Last updated:** [February 14, 2025, 12:43am UTC](https://discuss.elastic.co/t/how-to-reduce-false-positives-for-prebuilt-windows-security-ml-jobs/374532 "2025-02-14T00:43:49Z")
Hello, I've been running Elastic Clouds prebuilt machine learning jobs for Windows Security for about a month now and I've found they create a lot of noise. About 99% of the alerts I get out of these ML jobs I end up clo… --- ## [Elastic Endpoint stuck "STARTING"](https://discuss.elastic.co/t/elastic-endpoint-stuck-starting/374437)
**Author:** [@pok\_lehbim](https://discuss.elastic.co/u/pok_lehbim)\ **Replies:** 3\ **Last updated:** [February 13, 2025, 3:31pm UTC](https://discuss.elastic.co/t/elastic-endpoint-stuck-starting/374437 "2025-02-13T15:31:42Z")
I set up an agent policy with a few other integrations that work fine, the only one that is causing trouble is Elastic Defend. Despite using the default configuration it is not working. Here is all I've been able to gat… --- ## [Elastic Alerting](https://discuss.elastic.co/t/elastic-alerting/374474)
**Author:** [@amarasinghe.kaluarac](https://discuss.elastic.co/u/amarasinghe.kaluarac)\ **Replies:** 1\ **Last updated:** [February 13, 2025, 6:34am UTC](https://discuss.elastic.co/t/elastic-alerting/374474 "2025-02-13T06:34:15Z")
Hi all, I am creating a alerting system with elastic connectors , so far now i am able to send alerts to telegrame via a bot but the issue is the details of the alerts for a example: I have a rule for firewall login fa… --- ## [What are the similarities and/or differences between Rare Jobs and Population Jobs in Elastic Cloud Machine Learning for Anomaly Detection?](https://discuss.elastic.co/t/what-are-the-similarities-and-or-differences-between-rare-jobs-and-population-jobs-in-elastic-cloud-machine-learning-for-anomaly-detection/374460)
**Author:** [@Illya\_Bjazevic](https://discuss.elastic.co/u/Illya_Bjazevic)\ **Replies:** 0\ **Last updated:** [February 12, 2025, 10:25pm UTC](https://discuss.elastic.co/t/what-are-the-similarities-and-or-differences-between-rare-jobs-and-population-jobs-in-elastic-cloud-machine-learning-for-anomaly-detection/374460 "2025-02-12T22:25:47Z")
Entities or events in your data can be considered anomalous when: Their behavior changes over time, relative to their own previous behavior, or Their behavior is different than other entities in a specified population. … --- ## [How to Retrieve More Than 10K Records in EQL (\_eql/search)? (Elasticsearch 7.10.1)](https://discuss.elastic.co/t/how-to-retrieve-more-than-10k-records-in-eql-eql-search-elasticsearch-7-10-1/374264)
**Author:** [@Gkayy](https://discuss.elastic.co/u/Gkayy)\ **Replies:** 1\ **Last updated:** [February 11, 2025, 4:21pm UTC](https://discuss.elastic.co/t/how-to-retrieve-more-than-10k-records-in-eql-eql-search-elasticsearch-7-10-1/374264 "2025-02-11T16:21:18Z")
There is a limitation on Elastic search when doing a search for over 10k+ records, is there a way to retrieve records over 10k+? Note that I am using EQL query to retrieve records over endpoint \_EQL, I am aware that pagi… --- ## [Issue with Elastic Agent Imperva Integration](https://discuss.elastic.co/t/issue-with-elastic-agent-imperva-integration/374357)
**Author:** [@cyberm](https://discuss.elastic.co/u/cyberm)\ **Replies:** 0\ **Last updated:** [February 11, 2025, 11:26am UTC](https://discuss.elastic.co/t/issue-with-elastic-agent-imperva-integration/374357 "2025-02-11T11:26:07Z")
Hi all, We are experiencing the same issue as described in this previous post (Elastic Agent Imperva Integration , from @mgotechlock ), which was closed as unresolved. We are investigating the cause of this anomaly. Ha… --- ## [Bypassing elastic login when accessing kibana](https://discuss.elastic.co/t/bypassing-elastic-login-when-accessing-kibana/374231)
**Author:** [@Diler\_Mohammed](https://discuss.elastic.co/u/Diler_Mohammed)\ **Replies:** 3\ **Last updated:** [February 10, 2025, 3:39pm UTC](https://discuss.elastic.co/t/bypassing-elastic-login-when-accessing-kibana/374231 "2025-02-10T15:39:31Z")
Currently I have security enabled for my elk stack. When going to http://localhost:5601 for Kibana I get a login prompt and I enter the credentials for my elastic username and password. I want to bypass this login screen… --- ## [AzureDevOps ingestion](https://discuss.elastic.co/t/azuredevops-ingestion/374235)
**Author:** [@Cristina\_Marletta\_Li](https://discuss.elastic.co/u/Cristina_Marletta_Li)\ **Replies:** 0\ **Last updated:** [February 7, 2025, 5:06pm UTC](https://discuss.elastic.co/t/azuredevops-ingestion/374235 "2025-02-07T17:06:02Z")
Hi all, We have Azure Devops where we perform application deployment. We would like to ingest audit logs contained in the AzureDevOps table. I don't think there are any integrations to do this. Obviously, Azure exposes … --- ## [Fortiweb Cloud custom integration](https://discuss.elastic.co/t/fortiweb-cloud-custom-integration/374184)
**Author:** [@Cristina\_Marletta\_Li](https://discuss.elastic.co/u/Cristina_Marletta_Li)\ **Replies:** 3\ **Last updated:** [February 6, 2025, 4:31pm UTC](https://discuss.elastic.co/t/fortiweb-cloud-custom-integration/374184 "2025-02-06T16:31:58Z")
Hi all, I would like to know if there is a possibility and it is documented to make a custom integration where it is not available. In particular, I need to integrate FortiWeb Cloud events that make them available via A… --- ## [Do FIM integration can also monitor the log files?](https://discuss.elastic.co/t/do-fim-integration-can-also-monitor-the-log-files/374158)
**Author:** [@evangelin](https://discuss.elastic.co/u/evangelin)\ **Replies:** 4\ **Last updated:** [February 6, 2025, 12:44pm UTC](https://discuss.elastic.co/t/do-fim-integration-can-also-monitor-the-log-files/374158 "2025-02-06T12:44:59Z")
Hello team, I'm using the FIM integration from ELK i have added the paths like /etc/passwd , /etc/group and /var/log/dpkg.log. I'm getting getting printed if any changes observer in /etc/passwd , /etc/group But its… --- ## [Comparison of Different Elastic License Types](https://discuss.elastic.co/t/comparison-of-different-elastic-license-types/374156)
**Author:** [@Illya\_Bjazevic](https://discuss.elastic.co/u/Illya_Bjazevic)\ **Replies:** 2\ **Last updated:** [February 6, 2025, 2:01am UTC](https://discuss.elastic.co/t/comparison-of-different-elastic-license-types/374156 "2025-02-06T02:01:01Z")
I need a comparison of different Elastic license types. I found the following link, which is very comprehensive. However, it does not include the free version. We have the paid version in some areas, but my team wants to… --- ## [How does the look-back time of detection rules work?](https://discuss.elastic.co/t/how-does-the-look-back-time-of-detection-rules-work/374118)
**Author:** [@pok\_lehbim](https://discuss.elastic.co/u/pok_lehbim)\ **Replies:** 1\ **Last updated:** [February 5, 2025, 12:48pm UTC](https://discuss.elastic.co/t/how-does-the-look-back-time-of-detection-rules-work/374118 "2025-02-05T12:48:56Z")
What time period do rules look over when they are ran (automatically)? Is that defined by the look-back time we set? If that's the case, I've come across some odd behavior from a custom threshold rule (grouped by 3 occu… --- ## [How do I use Exceptions\_list and Alert\_Suppressions schemas for detections in TOML format?](https://discuss.elastic.co/t/how-do-i-use-exceptions-list-and-alert-suppressions-schemas-for-detections-in-toml-format/374036)
**Author:** [@obsidian](https://discuss.elastic.co/u/obsidian)\ **Replies:** 0\ **Last updated:** [February 3, 2025, 11:42pm UTC](https://discuss.elastic.co/t/how-do-i-use-exceptions-list-and-alert-suppressions-schemas-for-detections-in-toml-format/374036 "2025-02-03T23:42:49Z")
Per the detection rules API documentation and elastic detection rules repo, I am unable to find examples of how to use these objects in TOML format. How would these schema's look in TOML? My detections show up in elastic… --- ## [Basic Auth](https://discuss.elastic.co/t/basic-auth/374000)
**Author:** [@Harish\_R](https://discuss.elastic.co/u/Harish_R)\ **Replies:** 0\ **Last updated:** [February 3, 2025, 5:59am UTC](https://discuss.elastic.co/t/basic-auth/374000 "2025-02-03T05:59:01Z")
https:///kibana/login?next=%2Fkibana%2F when i hit the above URL with my original domain name i am able to see the welcome screen but it is getting logged out all of the sudden. Without the authentication it is working. … --- ## [Carbon Black Cloud integration with API v7 not working](https://discuss.elastic.co/t/carbon-black-cloud-integration-with-api-v7-not-working/373227)
**Author:** [@lizaro](https://discuss.elastic.co/u/lizaro)\ **Replies:** 1\ **Last updated:** [January 31, 2025, 6:52pm UTC](https://discuss.elastic.co/t/carbon-black-cloud-integration-with-api-v7-not-working/373227 "2025-01-31T18:52:46Z")
Hi everyone, I am new to Elastic Security and currently using an Elastic Cloud deployment for testing purposes, as my company is considering adopting it. We aim to forward alerts and audit logs from our Carbon Black Cl… --- ## [Rule Optimization](https://discuss.elastic.co/t/rule-optimization/373387)
**Author:** [@SebJen](https://discuss.elastic.co/u/SebJen)\ **Replies:** 1\ **Last updated:** [January 31, 2025, 6:50pm UTC](https://discuss.elastic.co/t/rule-optimization/373387 "2025-01-31T18:50:27Z")
Hello, I have a general question about designing optimal rules. To my understanding there are three ways of constructing exclusions/filtering : Directly in the query with "NOT" statements Add as a filter Rule exceptio… --- ## [Fleet policy and namespace in security alert context](https://discuss.elastic.co/t/fleet-policy-and-namespace-in-security-alert-context/373816)
**Author:** [@catn0b0t](https://discuss.elastic.co/u/catn0b0t)\ **Replies:** 5\ **Last updated:** [January 31, 2025, 5:39pm UTC](https://discuss.elastic.co/t/fleet-policy-and-namespace-in-security-alert-context/373816 "2025-01-31T17:39:54Z")
We have just recently started to adopt Elastic Defend and really impressed by it. One thing I found inconvenient is that the output alerts don't mention the fleet policy or datastream namespace. We have our fleet segment… --- ## [Built-in CEL within Custom Threat Intelligence Integration](https://discuss.elastic.co/t/built-in-cel-within-custom-threat-intelligence-integration/373945)
**Author:** [@Akodo](https://discuss.elastic.co/u/Akodo)\ **Replies:** 2\ **Last updated:** [January 31, 2025, 5:07pm UTC](https://discuss.elastic.co/t/built-in-cel-within-custom-threat-intelligence-integration/373945 "2025-01-31T17:07:05Z")
Morning. I found this integration in pre-release, Custom Threat Intelligence, and it fits perfect into our TI feed for hashes with a Trend Micro server we have. But I'm running into an issue, where I'm getting a CEL erro… --- ## [Issue with Hourly Data Collection When Initial Interval Has No Data](https://discuss.elastic.co/t/issue-with-hourly-data-collection-when-initial-interval-has-no-data/373936)
**Author:** [@Akshraj\_Chavda](https://discuss.elastic.co/u/Akshraj_Chavda)\ **Replies:** 2\ **Last updated:** [January 31, 2025, 4:48pm UTC](https://discuss.elastic.co/t/issue-with-hourly-data-collection-when-initial-interval-has-no-data/373936 "2025-01-31T16:48:54Z")
I am trying to collect data from an API using CEL filebeat! The API returns data in hourly chunks. The API expects a parameter in the format YYYY-MM-DD:HH, and when queried, it provides data generated during that specifi… --- ## [Ti\_abusech-2 - issue](https://discuss.elastic.co/t/ti-abusech-2-issue/373939)
**Author:** [@Charles\_Nkuna](https://discuss.elastic.co/u/Charles_Nkuna)\ **Replies:** 1\ **Last updated:** [January 31, 2025, 4:42pm UTC](https://discuss.elastic.co/t/ti-abusech-2-issue/373939 "2025-01-31T16:42:57Z")
Hello, Please assist we getting the error below for ti\_abusech-2 and it makes the fleet server unhealthy Any idea how you can fix this issue ? Your assistance will be highly appreciated Thanks [Previous page](https://discuss.elastic.co/c/security/83.md?page=6) [Next page](https://discuss.elastic.co/c/security/83.md?page=8)