# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=8 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 9 --- ## [Feature request: duplicate security rule exceptions](https://discuss.elastic.co/t/feature-request-duplicate-security-rule-exceptions/373937)
**Author:** [@catn0b0t](https://discuss.elastic.co/u/catn0b0t)\ **Replies:** 1\ **Last updated:** [January 31, 2025, 4:19pm UTC](https://discuss.elastic.co/t/feature-request-duplicate-security-rule-exceptions/373937 "2025-01-31T16:19:40Z")
Getting my feet wet in security exceptions and noticing the lack of a "duplicate exception" feature. Especially if you have large complicated exception rules that you want to diversify it would be very useful if you can … --- ## [Grouping Data Streams Based on Privilege Levels in UI](https://discuss.elastic.co/t/grouping-data-streams-based-on-privilege-levels-in-ui/373938)
**Author:** [@Akshraj\_Chavda](https://discuss.elastic.co/u/Akshraj_Chavda)\ **Replies:** 0\ **Last updated:** [January 31, 2025, 1:09pm UTC](https://discuss.elastic.co/t/grouping-data-streams-based-on-privilege-levels-in-ui/373938 "2025-01-31T13:09:57Z")
I have three data streams: data\_stream\_one data\_stream\_two data\_stream\_three And a single data collection input: CEL. Privilege Levels: Level C → Can access data\_stream\_one Level B → Can access data\_stream\_one and d… --- ## [Elastic Agent config requirements for "Hosts File Modified" rule](https://discuss.elastic.co/t/elastic-agent-config-requirements-for-hosts-file-modified-rule/373854)
**Author:** [@justin2](https://discuss.elastic.co/u/justin2)\ **Replies:** 0\ **Last updated:** [January 29, 2025, 5:53pm UTC](https://discuss.elastic.co/t/elastic-agent-config-requirements-for-hosts-file-modified-rule/373854 "2025-01-29T17:53:18Z")
Hello, I'm testing how some Elastic Security rules work with Beats versus Agents. I was curious about the integration requirements for the "Hosts File Modified" rule (link). Per the setup section for the "Hosts File Mo… --- ## [Create Cases with Elastic Security Rule Alerts](https://discuss.elastic.co/t/create-cases-with-elastic-security-rule-alerts/373067)
**Author:** [@logalicious](https://discuss.elastic.co/u/logalicious)\ **Replies:** 2\ **Last updated:** [January 27, 2025, 1:14pm UTC](https://discuss.elastic.co/t/create-cases-with-elastic-security-rule-alerts/373067 "2025-01-27T13:14:19Z")
Is there a way to create cases automatically when specific Security Rules trigger? I see lots of integrations for third-party case management tools, but I do not see any way to integrate security rules with Elastic Cases… --- ## [Elasticsearch security rule and alert testing](https://discuss.elastic.co/t/elasticsearch-security-rule-and-alert-testing/373610)
**Author:** [@MarcTan](https://discuss.elastic.co/u/MarcTan)\ **Replies:** 2\ **Last updated:** [January 27, 2025, 5:20am UTC](https://discuss.elastic.co/t/elasticsearch-security-rule-and-alert-testing/373610 "2025-01-27T05:20:18Z")
Hi all, I am testing out Elasticsearch security rule: User added to Privileged Group in Active Directory: User Added to Privileged Group in Active Directory | Elastic Security Solution \[7.17\] | Elastic I have an activ… --- ## [Is it possible to set kibana.alert.workflow as mandatory field](https://discuss.elastic.co/t/is-it-possible-to-set-kibana-alert-workflow-as-mandatory-field/372840)
**Author:** [@marcou](https://discuss.elastic.co/u/marcou)\ **Replies:** 1\ **Last updated:** [January 24, 2025, 1:00pm UTC](https://discuss.elastic.co/t/is-it-possible-to-set-kibana-alert-workflow-as-mandatory-field/372840 "2025-01-24T13:00:08Z")
Hello everyone, We are looking for a way in Elastic Security to define the kibana.alert.workflow\_tags field as a mandatory field. The goal is that you cannot simply close alerts, but first have to set the kibana.alert.… --- ## [Elasticsearch Shared Exception Lists](https://discuss.elastic.co/t/elasticsearch-shared-exception-lists/373456)
**Author:** [@iremtoru](https://discuss.elastic.co/u/iremtoru)\ **Replies:** 2\ **Last updated:** [January 23, 2025, 2:22pm UTC](https://discuss.elastic.co/t/elasticsearch-shared-exception-lists/373456 "2025-01-23T14:22:06Z")
Hello, I created some shared exception lists for some known and legit bots used in user agents and associated it with some of my detection rules but when I checked the results I am still seeing the them. I found the do… --- ## [53 / 5.000 Elastic defend allows all files in a directory](https://discuss.elastic.co/t/53-5-000-elastic-defend-allows-all-files-in-a-directory/373528)
**Author:** [@ArgoAdvisory](https://discuss.elastic.co/u/ArgoAdvisory)\ **Replies:** 1\ **Last updated:** [January 22, 2025, 5:40pm UTC](https://discuss.elastic.co/t/53-5-000-elastic-defend-allows-all-files-in-a-directory/373528 "2025-01-22T17:40:35Z")
Good morning everyone. I have installed Elastic Defend \\ Endpoint Security on my Windows computer. I would like every file in a specific folder: Example, C:\\directory\* not to be blocked. I have already tried to put … --- ## [Elastic Defend on windows 2012R2](https://discuss.elastic.co/t/elastic-defend-on-windows-2012r2/373459)
**Author:** [@Charles\_Nkuna](https://discuss.elastic.co/u/Charles_Nkuna)\ **Replies:** 3\ **Last updated:** [January 22, 2025, 12:02pm UTC](https://discuss.elastic.co/t/elastic-defend-on-windows-2012r2/373459 "2025-01-22T12:02:07Z")
Hi, i want integrate elastic defend on server windows 2012R2 we get this warning below: is there a way we can implement this integration or some sort of Legacy integration we can apply on the servers. --- ## [Unable to add tag "Security Solution" in Elastic Security Serverless](https://discuss.elastic.co/t/unable-to-add-tag-security-solution-in-elastic-security-serverless/373206)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 4\ **Last updated:** [January 21, 2025, 5:30pm UTC](https://discuss.elastic.co/t/unable-to-add-tag-security-solution-in-elastic-security-serverless/373206 "2025-01-21T17:30:07Z")
Hello, So I seem unable to select the "Security Solution" tag for dashboards in Elastic Security Serverless? I was able to add it by exporting the saved object and manually adding it to the json and reimporting it, … --- ## [Delete file from Elastic XDR](https://discuss.elastic.co/t/delete-file-from-elastic-xdr/371655)
**Author:** [@Charles\_Nkuna](https://discuss.elastic.co/u/Charles_Nkuna)\ **Replies:** 5\ **Last updated:** [January 21, 2025, 10:55am UTC](https://discuss.elastic.co/t/delete-file-from-elastic-xdr/371655 "2025-01-21T10:55:41Z")
Hello everyone, Is it possible or if there's way to delete a file from the console detected by Elastic defend.? --- ## [The issue of revising the basic license](https://discuss.elastic.co/t/the-issue-of-revising-the-basic-license/373351)
**Author:** [@vovan13111](https://discuss.elastic.co/u/vovan13111)\ **Replies:** 2\ **Last updated:** [January 19, 2025, 8:55am UTC](https://discuss.elastic.co/t/the-issue-of-revising-the-basic-license/373351 "2025-01-19T08:55:55Z")
Good afternoon! Can you tell me if there will be a revision of the possibility of using ldap and email notifications in the basic license this year? In my opinion, if you allow integration only with ldap, perhaps even w… --- ## [Elastic Security: Strategies for Analyzing Large Files (Over 500MB)](https://discuss.elastic.co/t/elastic-security-strategies-for-analyzing-large-files-over-500mb/373253)
**Author:** [@Illya\_Bjazevic](https://discuss.elastic.co/u/Illya_Bjazevic)\ **Replies:** 2\ **Last updated:** [January 16, 2025, 2:45am UTC](https://discuss.elastic.co/t/elastic-security-strategies-for-analyzing-large-files-over-500mb/373253 "2025-01-16T02:45:24Z")
I am new to Elastic. I discovered that with the File Data Visualizer, we can upload files up to 500MB. Is there an "official" strategy to analyze larger files, such as dividing the data into chunks and later combining th… --- ## [Does Endgame Sensor support MacOS 15 Sequoia?](https://discuss.elastic.co/t/does-endgame-sensor-support-macos-15-sequoia/373106)
**Author:** [@SLDM](https://discuss.elastic.co/u/SLDM)\ **Replies:** 2\ **Last updated:** [January 13, 2025, 3:20pm UTC](https://discuss.elastic.co/t/does-endgame-sensor-support-macos-15-sequoia/373106 "2025-01-13T15:20:09Z")
Is the Endgame Sensor supported in MacOS 15 Sequoia? I checked the support matrix for Endgame and it hasn't been updated since 2023, so I am a bit confused. --- ## [Pending status when i started scan](https://discuss.elastic.co/t/pending-status-when-i-started-scan/373109)
**Author:** [@Bumin\_Qagan](https://discuss.elastic.co/u/Bumin_Qagan)\ **Replies:** 1\ **Last updated:** [January 13, 2025, 12:47pm UTC](https://discuss.elastic.co/t/pending-status-when-i-started-scan/373109 "2025-01-13T12:47:52Z")
I have started scan and got status pending for like 2 - 3 days and more --- ## [Unable to start Kibana after upgrade to 8.17.0](https://discuss.elastic.co/t/unable-to-start-kibana-after-upgrade-to-8-17-0/373015)
**Author:** [@jheaton](https://discuss.elastic.co/u/jheaton)\ **Replies:** 4\ **Last updated:** [January 10, 2025, 3:11pm UTC](https://discuss.elastic.co/t/unable-to-start-kibana-after-upgrade-to-8-17-0/373015 "2025-01-10T15:11:52Z")
Following an upgrade of Kibana the Kibana service keeps shutting down and restarting and the web interface is unavailable. The current issue appears to be permission related on an index called ".kibana\_task\_manager\_8.7.… --- ## [SIEM detection rule](https://discuss.elastic.co/t/siem-detection-rule/372978)
**Author:** [@aravindraja](https://discuss.elastic.co/u/aravindraja)\ **Replies:** 1\ **Last updated:** [January 9, 2025, 4:42pm UTC](https://discuss.elastic.co/t/siem-detection-rule/372978 "2025-01-09T16:42:27Z")
Hi Folks, Enabling all the SIEM detection rules will consume resource at agent end? And also, is it a best practice to enable all the prebuilt SIEM detection rules? Thanks in advance --- ## [Elastic SIEM - Hardware specs](https://discuss.elastic.co/t/elastic-siem-hardware-specs/372481)
**Author:** [@stephanenm](https://discuss.elastic.co/u/stephanenm)\ **Replies:** 3\ **Last updated:** [January 8, 2025, 2:52pm UTC](https://discuss.elastic.co/t/elastic-siem-hardware-specs/372481 "2025-01-08T14:52:44Z")
Hello all, I am trying to find some specs stuff to improve a build on a Elastick SIEM full on prem (I know it's time for the cloud computing but I need to make this on premise ^^) So I am trying to find some documentat… --- ## [Recommended field types for writing detections on with lucene](https://discuss.elastic.co/t/recommended-field-types-for-writing-detections-on-with-lucene/372174)
**Author:** [@gbL2k](https://discuss.elastic.co/u/gbL2k)\ **Replies:** 1\ **Last updated:** [January 8, 2025, 2:39pm UTC](https://discuss.elastic.co/t/recommended-field-types-for-writing-detections-on-with-lucene/372174 "2025-01-08T14:39:29Z")
Hey! What are the recommended types of fields to write detections on with lucene? I want my queries to be case insensitive but still perform exact matching and wildcarding. Searching on text fields with wildcards prod… --- ## [Threat Intel Without Elastic Agent](https://discuss.elastic.co/t/threat-intel-without-elastic-agent/372834)
**Author:** [@aadityar](https://discuss.elastic.co/u/aadityar)\ **Replies:** 5\ **Last updated:** [January 8, 2025, 8:38am UTC](https://discuss.elastic.co/t/threat-intel-without-elastic-agent/372834 "2025-01-08T08:38:01Z")
Hi! I'm trying to use Elastic's Threat Intelligence modules without having to use any kind of agents. My elastic server is receiving parsed logs from logstash into specific indices. These indices have the fields 'ip' a… --- ## [Elastic Agents becoming unhealthy due to Elastic Defend Integration](https://discuss.elastic.co/t/elastic-agents-becoming-unhealthy-due-to-elastic-defend-integration/372768)
**Author:** [@RedneckHutch](https://discuss.elastic.co/u/RedneckHutch)\ **Replies:** 1\ **Last updated:** [January 6, 2025, 3:56pm UTC](https://discuss.elastic.co/t/elastic-agents-becoming-unhealthy-due-to-elastic-defend-integration/372768 "2025-01-06T15:56:04Z")
Happy New Years! We have encountered an issue with our Elastic Agents becoming unhealthy due to the Elastic Defend integration being Degraded. We have ~110 Elastic Agents that are contained within multiple agent policie… --- ## [Question About the ‘Supplied Configurations’ Section in Anomaly Detection for Time Series Data with Machine Learning on Elastic Cloud 8.17](https://discuss.elastic.co/t/question-about-the-supplied-configurations-section-in-anomaly-detection-for-time-series-data-with-machine-learning-on-elastic-cloud-8-17/372340)
**Author:** [@Illya\_Bjazevic](https://discuss.elastic.co/u/Illya_Bjazevic)\ **Replies:** 4\ **Last updated:** [January 2, 2025, 9:21pm UTC](https://discuss.elastic.co/t/question-about-the-supplied-configurations-section-in-anomaly-detection-for-time-series-data-with-machine-learning-on-elastic-cloud-8-17/372340 "2025-01-02T21:21:30Z")
While using Anomaly Detection in Time Series Data with Machine Learning in Elastic Cloud 8.17, I came across the 'Supplied Configurations' section. When I clicked there, I found what is shown in the following image: … --- ## [Regarding Cross cluster replication](https://discuss.elastic.co/t/regarding-cross-cluster-replication/372349)
**Author:** [@mike123](https://discuss.elastic.co/u/mike123)\ **Replies:** 4\ **Last updated:** [December 24, 2024, 6:24pm UTC](https://discuss.elastic.co/t/regarding-cross-cluster-replication/372349 "2024-12-24T18:24:45Z")
I am having a ES cluster with Fleet server, Kibana and elastic-agents. I want to create a DR (Disaster recovery ) setup for it. I am running alerts and ML rules with Elastic Defent in this setup. If i go for bi direction… --- ## [Problems with AI Assistant AWS Bedrock inside Elastic Cloud Security](https://discuss.elastic.co/t/problems-with-ai-assistant-aws-bedrock-inside-elastic-cloud-security/372249)
**Author:** [@Illya\_Bjazevic](https://discuss.elastic.co/u/Illya_Bjazevic)\ **Replies:** 1\ **Last updated:** [December 20, 2024, 12:07am UTC](https://discuss.elastic.co/t/problems-with-ai-assistant-aws-bedrock-inside-elastic-cloud-security/372249 "2024-12-20T00:07:07Z")
AWS Bedwork is passing the test inside Elastic Cloud but it is not working. Any idea about how can I solve this problem? When I try to use AWS Bedrock I get the following error: ActionsClient BedrockRuntimeClient: ac… --- ## [How to configure AWS Bedrock in AI Assistant inside Elastic Cloud?](https://discuss.elastic.co/t/how-to-configure-aws-bedrock-in-ai-assistant-inside-elastic-cloud/372185)
**Author:** [@Illya\_Bjazevic](https://discuss.elastic.co/u/Illya_Bjazevic)\ **Replies:** 3\ **Last updated:** [December 19, 2024, 5:12pm UTC](https://discuss.elastic.co/t/how-to-configure-aws-bedrock-in-ai-assistant-inside-elastic-cloud/372185 "2024-12-19T17:12:16Z")
I am trying to configure AWS Bedrock in AI Assistant inside Elastic Cloud. By default the only empty sections are Access key and Secret. I just opened a new AWS account and I got access to Claude 3.5 Sonnet that is the … --- ## [Help with EQL Rule to Detect Unauthorized State Transitions for Traffic Lights](https://discuss.elastic.co/t/help-with-eql-rule-to-detect-unauthorized-state-transitions-for-traffic-lights/371956)
**Author:** [@Kuly2Fraise](https://discuss.elastic.co/u/Kuly2Fraise)\ **Replies:** 6\ **Last updated:** [December 19, 2024, 9:35am UTC](https://discuss.elastic.co/t/help-with-eql-rule-to-detect-unauthorized-state-transitions-for-traffic-lights/371956 "2024-12-19T09:35:54Z")
Hi Elastic Community, I’m currently working on a project where I need to detect unauthorized state transitions for traffic lights in a real-time event stream using Elastic EQL. I’ve already set up the state machine and … --- ## [How to use Alert Supression object in TOML format for threshold rules?](https://discuss.elastic.co/t/how-to-use-alert-supression-object-in-toml-format-for-threshold-rules/372175)
**Author:** [@obsidian](https://discuss.elastic.co/u/obsidian)\ **Replies:** 0\ **Last updated:** [December 18, 2024, 4:37pm UTC](https://discuss.elastic.co/t/how-to-use-alert-supression-object-in-toml-format-for-threshold-rules/372175 "2024-12-18T16:37:04Z")
I am trying to use the alert supression schema for a threshold rule but only the threshold field and value and cardinality field and value are showing up in elastic and not the alert supression, how do I add that into th… --- ## [ELK security setup](https://discuss.elastic.co/t/elk-security-setup/371791)
**Author:** [@Diler\_Mohammed](https://discuss.elastic.co/u/Diler_Mohammed)\ **Replies:** 7\ **Last updated:** [December 17, 2024, 11:58pm UTC](https://discuss.elastic.co/t/elk-security-setup/371791 "2024-12-17T23:58:55Z")
Hello all, I'm currently running a manual security setup for my elasticsearch, logstash, and kibana docker containers. I've setup dockerfiles, and docker-entrypoints for each of these containers. Also I generated self … --- ## [Elastic integration and agent policy configuration](https://discuss.elastic.co/t/elastic-integration-and-agent-policy-configuration/371957)
**Author:** [@aravindraja](https://discuss.elastic.co/u/aravindraja)\ **Replies:** 1\ **Last updated:** [December 13, 2024, 1:17pm UTC](https://discuss.elastic.co/t/elastic-integration-and-agent-policy-configuration/371957 "2024-12-13T13:17:16Z")
Hello Folks, I'm writing this to get a clear understanding on deploying the agent policies and necessary integrations. I have an environment of 300 endpoints including Windows and Linux systems, I have installed elasti… --- ## [Elastic EDR Problem](https://discuss.elastic.co/t/elastic-edr-problem/371748)
**Author:** [@Aliya\_Khalel](https://discuss.elastic.co/u/Aliya_Khalel)\ **Replies:** 1\ **Last updated:** [December 12, 2024, 6:03pm UTC](https://discuss.elastic.co/t/elastic-edr-problem/371748 "2024-12-12T18:03:01Z")
We using Fleet-managed Elastic Agent. All agents has policies have Elastic Defend integration. We are using Enteprise License. Can EDR decrease speed of downloading files from Whatsapp? Why I don't see Malware Preven… [Previous page](https://discuss.elastic.co/c/security/83.md?page=7) [Next page](https://discuss.elastic.co/c/security/83.md?page=9)