# Elastic Security **URL:** https://discuss.elastic.co/c/security/83.md?page=9 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 10 --- ## [Elastic Agent preventing standby](https://discuss.elastic.co/t/elastic-agent-preventing-standby/371598)
**Author:** [@michael-a](https://discuss.elastic.co/u/michael-a)\ **Replies:** 4\ **Last updated:** [December 12, 2024, 2:57pm UTC](https://discuss.elastic.co/t/elastic-agent-preventing-standby/371598 "2024-12-12T14:57:23Z")
We have an issue with Linux (RHEL) klients that won't go into standby, which seem to have started in 8.12, possibly related to presets in Elastic 8.12. We're on the Basic license if that makes any difference. --- ## [Problem with the display of the hostname in Kibana alerts, despite its definition in ‘Custom Highlighted Fields’](https://discuss.elastic.co/t/problem-with-the-display-of-the-hostname-in-kibana-alerts-despite-its-definition-in-custom-highlighted-fields/371838)
**Author:** [@Kuly2Fraise](https://discuss.elastic.co/u/Kuly2Fraise)\ **Replies:** 2\ **Last updated:** [December 12, 2024, 2:37pm UTC](https://discuss.elastic.co/t/problem-with-the-display-of-the-hostname-in-kibana-alerts-despite-its-definition-in-custom-highlighted-fields/371838 "2024-12-12T14:37:25Z")
Hello, I'm having a problem with alerts in Kibana. I defined the hostname as a custom field in the ‘custom highlighted fields’ in the definition of my alert rule, but the hostname is not displayed in the generated alert… --- ## [Agentless Setup for Elastic SIEM](https://discuss.elastic.co/t/agentless-setup-for-elastic-siem/371504)
**Author:** [@lastshadow](https://discuss.elastic.co/u/lastshadow)\ **Replies:** 4\ **Last updated:** [December 12, 2024, 12:41pm UTC](https://discuss.elastic.co/t/agentless-setup-for-elastic-siem/371504 "2024-12-12T12:41:32Z")
I've used Elastic SIEM before but always in environments where the Elastic agent can be deployed to endpoints and servers. In my current environment I cannot deploy the agent. I have both Linux and Windows boxes. Questi… --- ## [Deciding between Elastic and MDE?](https://discuss.elastic.co/t/deciding-between-elastic-and-mde/371864)
**Author:** [@Seorod12](https://discuss.elastic.co/u/Seorod12)\ **Replies:** 1\ **Last updated:** [December 11, 2024, 8:53pm UTC](https://discuss.elastic.co/t/deciding-between-elastic-and-mde/371864 "2024-12-11T20:53:22Z")
Why elastic and Microsoft Defender for Endpoint? --- ## [On demand Rule execution](https://discuss.elastic.co/t/on-demand-rule-execution/371818)
**Author:** [@Kuly2Fraise](https://discuss.elastic.co/u/Kuly2Fraise)\ **Replies:** 4\ **Last updated:** [December 11, 2024, 11:55am UTC](https://discuss.elastic.co/t/on-demand-rule-execution/371818 "2024-12-11T11:55:21Z")
Hello, I have a rule in Kibana that counts the number of packets received for a given wlan-src every second. This is the current setup: Custom query: event.wlan-src: \* Runs every 1 second Threshold: 63 packets How… --- ## [Elastic agent](https://discuss.elastic.co/t/elastic-agent/371698)
**Author:** [@searchwithme](https://discuss.elastic.co/u/searchwithme)\ **Replies:** 1\ **Last updated:** [December 11, 2024, 3:09am UTC](https://discuss.elastic.co/t/elastic-agent/371698 "2024-12-11T03:09:59Z")
Hello! Which elastic agent is used to detect vulnerabilities if any? --- ## [Does Elastic AI Assistant work on the free trial of Elastic Cloud?](https://discuss.elastic.co/t/does-elastic-ai-assistant-work-on-the-free-trial-of-elastic-cloud/371794)
**Author:** [@Illya\_Bjazevic](https://discuss.elastic.co/u/Illya_Bjazevic)\ **Replies:** 3\ **Last updated:** [December 11, 2024, 1:08am UTC](https://discuss.elastic.co/t/does-elastic-ai-assistant-work-on-the-free-trial-of-elastic-cloud/371794 "2024-12-11T01:08:06Z")
I am getting an error that Elastic AI Assistant cannot connect to OpenAI. However, I created a new secret key there. The Elastic website says that an Enterprise subscription is required. Please see this link: AI Assista… --- ## [Elastic Threat Hunting](https://discuss.elastic.co/t/elastic-threat-hunting/371527)
**Author:** [@Charles\_Nkuna](https://discuss.elastic.co/u/Charles_Nkuna)\ **Replies:** 1\ **Last updated:** [December 5, 2024, 5:56pm UTC](https://discuss.elastic.co/t/elastic-threat-hunting/371527 "2024-12-05T17:56:19Z")
Hi, Just wanted to ask if there's any threat hunting queries available for SIEM and Elastic Defend ? Thanks --- ## [Any way to add assignees and/or tags in bulk?](https://discuss.elastic.co/t/any-way-to-add-assignees-and-or-tags-in-bulk/371485)
**Author:** [@ajtjavier](https://discuss.elastic.co/u/ajtjavier)\ **Replies:** 0\ **Last updated:** [December 4, 2024, 9:26pm UTC](https://discuss.elastic.co/t/any-way-to-add-assignees-and-or-tags-in-bulk/371485 "2024-12-04T21:26:06Z")
I can select all alerts past 100 count to mark them as open, closed, or acknowledged, but I cannot assign these alerts to a user or apply tags to them like True Positive - Benign and the like. The limit for these actions… --- ## [Cannot uninstall endpoint agent](https://discuss.elastic.co/t/cannot-uninstall-endpoint-agent/371315)
**Author:** [@LaserBits](https://discuss.elastic.co/u/LaserBits)\ **Replies:** 1\ **Last updated:** [December 4, 2024, 9:23am UTC](https://discuss.elastic.co/t/cannot-uninstall-endpoint-agent/371315 "2024-12-04T09:23:31Z")
I cannot uninstall the agent from a specific endpoint. The terminal command goes through and then forever hangs on the stopping service message. It appears to be running but never gets pass it. If I cannot uninstall , … --- ## [DGA integration with packetbeat](https://discuss.elastic.co/t/dga-integration-with-packetbeat/370232)
**Author:** [@Miguel\_Martinez](https://discuss.elastic.co/u/Miguel_Martinez)\ **Replies:** 2\ **Last updated:** [November 26, 2024, 9:05pm UTC](https://discuss.elastic.co/t/dga-integration-with-packetbeat/370232 "2024-11-26T21:05:40Z")
I am currently doing the DGA integration but I can't install elastic Defender, I have read that it can be done with packetbeat, can you help me how to do it, according to this DGA documentation I have done up to step 5 b… --- ## [O365 Exchange Suspicious Mailbox Right Delegation with wrong user.id?](https://discuss.elastic.co/t/o365-exchange-suspicious-mailbox-right-delegation-with-wrong-user-id/370092)
**Author:** [@RedneckHutch](https://discuss.elastic.co/u/RedneckHutch)\ **Replies:** 2\ **Last updated:** [November 26, 2024, 8:34pm UTC](https://discuss.elastic.co/t/o365-exchange-suspicious-mailbox-right-delegation-with-wrong-user-id/370092 "2024-11-26T20:34:50Z")
Hey everyone! We have enabled the Elastic Rule O365 Exchange Suspicious Mailbox Right Delegation. We enabled the default query which can seen below. event.dataset:o365.audit and event.provider:Exchange and event.action:… --- ## [ES|QL Get information about a grandparent process](https://discuss.elastic.co/t/es-ql-get-information-about-a-grandparent-process/371097)
**Author:** [@isugg](https://discuss.elastic.co/u/isugg)\ **Replies:** 0\ **Last updated:** [November 26, 2024, 7:15pm UTC](https://discuss.elastic.co/t/es-ql-get-information-about-a-grandparent-process/371097 "2024-11-26T19:15:41Z")
Hello! I have a PowerShell script that executes an encoded command that spawns some lolbin, let's say ipconfig. This is realized in Elastic as PowerShell spawning PowerShell, spawning ipconfig. I have an ES|QL detection … --- ## [Connecting an ES client with a kibana on Python](https://discuss.elastic.co/t/connecting-an-es-client-with-a-kibana-on-python/370991)
**Author:** [@ALXIReinar](https://discuss.elastic.co/u/ALXIReinar)\ **Replies:** 7\ **Last updated:** [November 26, 2024, 3:22pm UTC](https://discuss.elastic.co/t/connecting-an-es-client-with-a-kibana-on-python/370991 "2024-11-26T15:22:20Z")
This is the problem: I need Kibana and the ES client to work on python at the same time. At the same time, all security settings are enabled: xpack.security.enabled: true xpack.security.enrollment.enabled: true xpack.s… --- ## [What should I set "Document to index" so that the index connector write content of source log to index?](https://discuss.elastic.co/t/what-should-i-set-document-to-index-so-that-the-index-connector-write-content-of-source-log-to-index/370111)
**Author:** [@kevinlin](https://discuss.elastic.co/u/kevinlin)\ **Replies:** 6\ **Last updated:** [November 26, 2024, 7:21am UTC](https://discuss.elastic.co/t/what-should-i-set-document-to-index-so-that-the-index-connector-write-content-of-source-log-to-index/370111 "2024-11-26T07:21:07Z")
There is a log with field "winlog.logon.failure.sub\_status" and content is "User logon with misspelled or bad password" Refer to Index connector and action | Kibana Guide \[8.15\] | Elastic I created a rule that using in… --- ## [Kibana Query Language summarize](https://discuss.elastic.co/t/kibana-query-language-summarize/370825)
**Author:** [@fitastronaut](https://discuss.elastic.co/u/fitastronaut)\ **Replies:** 4\ **Last updated:** [November 25, 2024, 3:54am UTC](https://discuss.elastic.co/t/kibana-query-language-summarize/370825 "2024-11-25T03:54:54Z")
Hello gurus, I am new with Elastic and I have been searching to no avail. I am trying to create a SIEM rule for brute force. How do I write the query for this? In Microsoft Sentinel, it will be let threshold = 5; Tabl… --- ## [Database Use case for DDL and DML command](https://discuss.elastic.co/t/database-use-case-for-ddl-and-dml-command/370843)
**Author:** [@Airtel\_Center](https://discuss.elastic.co/u/Airtel_Center)\ **Replies:** 0\ **Last updated:** [November 20, 2024, 3:18pm UTC](https://discuss.elastic.co/t/database-use-case-for-ddl-and-dml-command/370843 "2024-11-20T15:18:23Z")
Can we create use cases for below points in database. if yes can you share the use cases details Database MSSQL - Create Table Database MSSQL - Delete Table Database MSSQL - Modify Table Database MSSQL - Insert Data … --- ## [Issues with NFS shares and mounting at startup - Linux clients](https://discuss.elastic.co/t/issues-with-nfs-shares-and-mounting-at-startup-linux-clients/370603)
**Author:** [@michael-a](https://discuss.elastic.co/u/michael-a)\ **Replies:** 5\ **Last updated:** [November 19, 2024, 8:31pm UTC](https://discuss.elastic.co/t/issues-with-nfs-shares-and-mounting-at-startup-linux-clients/370603 "2024-11-19T20:31:39Z")
We have an issue with our Linux clients running Agent v8.15.x (and have had before on earlier versions as well) where every NFS share gets mounted by the elastic agent user at time of boot - for no obvious reasons. We've… --- ## [ELK Keycloak OIDC Integration Error](https://discuss.elastic.co/t/elk-keycloak-oidc-integration-error/370635)
**Author:** [@Joshua\_Jerez](https://discuss.elastic.co/u/Joshua_Jerez)\ **Replies:** 4\ **Last updated:** [November 16, 2024, 7:25am UTC](https://discuss.elastic.co/t/elk-keycloak-oidc-integration-error/370635 "2024-11-16T07:25:34Z")
I have error when I logged in through keycloak for my kibana. There are error message. --- ## [Preserve Original](https://discuss.elastic.co/t/preserve-original/370394)
**Author:** [@aravindraja](https://discuss.elastic.co/u/aravindraja)\ **Replies:** 1\ **Last updated:** [November 13, 2024, 1:09pm UTC](https://discuss.elastic.co/t/preserve-original/370394 "2024-11-13T13:09:36Z")
Hi Team, By enabling the preserve original in my integration would actually consume large amount of disk space in my elastic server? Thanks in advance --- ## [Elastic defend with elastic instance in hetzner](https://discuss.elastic.co/t/elastic-defend-with-elastic-instance-in-hetzner/370442)
**Author:** [@Issam\_Zgybi](https://discuss.elastic.co/u/Issam_Zgybi)\ **Replies:** 1\ **Last updated:** [November 13, 2024, 9:00am UTC](https://discuss.elastic.co/t/elastic-defend-with-elastic-instance-in-hetzner/370442 "2024-11-13T09:00:47Z")
hello team, i have an elastic + kibana in a hetzner server behind pfsense, my problem is with elastic defend integration, the integration is not working! the agent apear as unhealthy, my setup is the elastic is accesibl… --- ## [RBAC Query](https://discuss.elastic.co/t/rbac-query/370405)
**Author:** [@Kiwisaki](https://discuss.elastic.co/u/Kiwisaki)\ **Replies:** 0\ **Last updated:** [November 12, 2024, 2:00pm UTC](https://discuss.elastic.co/t/rbac-query/370405 "2024-11-12T14:00:19Z")
I wish to grant some users the ability to manage security alert statuses and create cases, but i dont want them to be able to change any security rule settings. From what i can see i can only either give them full rights… --- ## [Elastic SIEM Detection Rules](https://discuss.elastic.co/t/elastic-siem-detection-rules/370390)
**Author:** [@aravindraja](https://discuss.elastic.co/u/aravindraja)\ **Replies:** 1\ **Last updated:** [November 12, 2024, 1:07pm UTC](https://discuss.elastic.co/t/elastic-siem-detection-rules/370390 "2024-11-12T13:07:51Z")
Hi Team, I have 2 windows endpoints with 2 different agent policies where in one endpoint I have integrated the system integration and in another endpoint I have integrated Windows, So in this case of SIEM detection rul… --- ## [I want to integrate Bitdefender into ELK](https://discuss.elastic.co/t/i-want-to-integrate-bitdefender-into-elk/370150)
**Author:** [@AB9494](https://discuss.elastic.co/u/AB9494)\ **Replies:** 5\ **Last updated:** [November 12, 2024, 4:59am UTC](https://discuss.elastic.co/t/i-want-to-integrate-bitdefender-into-elk/370150 "2024-11-12T04:59:56Z")
Hello, I am trying to integrate Bitdefender into ELK. I have generated the API key and added the Bitdefender integration to the Fleet Server policy with the required details. However, I am still not receiving any logs i… --- ## ['ScrInject' malware was detected](https://discuss.elastic.co/t/scrinject-malware-was-detected/370156)
**Author:** [@GKre](https://discuss.elastic.co/u/GKre)\ **Replies:** 4\ **Last updated:** [November 7, 2024, 8:19pm UTC](https://discuss.elastic.co/t/scrinject-malware-was-detected/370156 "2024-11-07T20:19:25Z")
I am receiving alerts in MS-Defender type " 'ScrInject' malware was detected". The context is elastic-endpoint.exe and some .ndjson files like elastic-agent-event-log-20241103-156.ndjson I made an exclusion as i think… --- ## [\[ERROR\] Winlogbeat cannot connect to Elastic](https://discuss.elastic.co/t/error-winlogbeat-cannot-connect-to-elastic/369845)
**Author:** [@marioaxavier7](https://discuss.elastic.co/u/marioaxavier7)\ **Replies:** 2\ **Last updated:** [November 5, 2024, 2:21pm UTC](https://discuss.elastic.co/t/error-winlogbeat-cannot-connect-to-elastic/369845 "2024-11-05T14:21:47Z")
Hello friends, I am trying connect Winlogbeat from my Windows PC to Elastic in Ubuntu Server. Unfortunately i received that message error: I try allow port 9200 in Windows and Ubuntu VM, but error continue I try d… --- ## [How to get a Trial License Extension?](https://discuss.elastic.co/t/how-to-get-a-trial-license-extension/370069)
**Author:** [@jbrunink](https://discuss.elastic.co/u/jbrunink)\ **Replies:** 3\ **Last updated:** [November 5, 2024, 12:57pm UTC](https://discuss.elastic.co/t/how-to-get-a-trial-license-extension/370069 "2024-11-05T12:57:17Z")
Hi, all, Sorry for being offtopic but I just can't seem to find any other way to get into contact with someone from Elastic. I was wondering how you'd get a Trial License Extension. I've put in a request through the we… --- ## [How to add tag value on specific conditions in Security alert rule](https://discuss.elastic.co/t/how-to-add-tag-value-on-specific-conditions-in-security-alert-rule/369685)
**Author:** [@Peter\_K](https://discuss.elastic.co/u/Peter_K)\ **Replies:** 5\ **Last updated:** [November 5, 2024, 11:23am UTC](https://discuss.elastic.co/t/how-to-add-tag-value-on-specific-conditions-in-security-alert-rule/369685 "2024-11-05T11:23:45Z")
Is there a solution for adding a value in a tag field or custom field by a alert rule when meeting specific conditions (IOC's). Purpose is to have new alerts marked by a tag (or better a custom field with an URI to the e… --- ## [Scanning the Host for malware](https://discuss.elastic.co/t/scanning-the-host-for-malware/369330)
**Author:** [@Charles\_Nkuna](https://discuss.elastic.co/u/Charles_Nkuna)\ **Replies:** 3\ **Last updated:** [November 4, 2024, 9:11pm UTC](https://discuss.elastic.co/t/scanning-the-host-for-malware/369330 "2024-11-04T21:11:53Z")
Hi Guys, I'm trying to scan a host using response action. looks like you can only scan a specific folder or directory rather than the entire host like C drive is it possible to scan the entire host ? And also whe… --- ## [Path exclude from scanning](https://discuss.elastic.co/t/path-exclude-from-scanning/369519)
**Author:** [@SandroR](https://discuss.elastic.co/u/SandroR)\ **Replies:** 3\ **Last updated:** [October 30, 2024, 9:17pm UTC](https://discuss.elastic.co/t/path-exclude-from-scanning/369519 "2024-10-30T21:17:10Z")
Hi, Is it possible to exclude paths from scanning in the Malware protection section? Best, Sandro [Previous page](https://discuss.elastic.co/c/security/83.md?page=8) [Next page](https://discuss.elastic.co/c/security/83.md?page=10)