# Endpoint Security **URL:** https://discuss.elastic.co/c/security/endpoint-security/80.md?page=1 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 2 --- ## [Failed install endpoint service: exit status 284](https://discuss.elastic.co/t/failed-install-endpoint-service-exit-status-284/379504)
**Author:** [@ArgoAdvisory](https://discuss.elastic.co/u/ArgoAdvisory)\ **Replies:** 4\ **Last updated:** [June 26, 2025, 3:28pm UTC](https://discuss.elastic.co/t/failed-install-endpoint-service-exit-status-284/379504 "2025-06-26T15:28:28Z")
Hello everyone, I am having this problem. I tried to uninstall Elastic Defend from a computer, but I can't... These are the things I tried: uninstall the agent: the agent is uninstalled successfully but the "Elastic… --- ## [About xpack.fleet.registryUrl option](https://discuss.elastic.co/t/about-xpack-fleet-registryurl-option/378333)
**Author:** [@rezgui](https://discuss.elastic.co/u/rezgui)\ **Replies:** 1\ **Last updated:** [June 12, 2025, 7:19am UTC](https://discuss.elastic.co/t/about-xpack-fleet-registryurl-option/378333 "2025-06-12T07:19:06Z")
hello i will like to know with url can get take the option xpack.fleet.registryUrl for kibana 8.3.4 version and i have an access to internet best regards --- ## [Temporarily disable Elastic Endpoint on a specific host](https://discuss.elastic.co/t/temporarily-disable-elastic-endpoint-on-a-specific-host/378634)
**Author:** [@ArgoAdvisory](https://discuss.elastic.co/u/ArgoAdvisory)\ **Replies:** 3\ **Last updated:** [May 28, 2025, 3:09pm UTC](https://discuss.elastic.co/t/temporarily-disable-elastic-endpoint-on-a-specific-host/378634 "2025-05-28T15:09:26Z")
Good morning everyone! I think Elastic Endpoint (or Elastic Defend) is a valid antivirus. I would like to understand one thing. How can I temporarily disable the antivirus on a specific host? I am the administrator, … --- ## [Open Source Vulnerabilities](https://discuss.elastic.co/t/open-source-vulnerabilities/378456)
**Author:** [@rajesh\_raghav](https://discuss.elastic.co/u/rajesh_raghav)\ **Replies:** 9\ **Last updated:** [May 28, 2025, 4:22am UTC](https://discuss.elastic.co/t/open-source-vulnerabilities/378456 "2025-05-28T04:22:20Z")
We observed there are several components used in Elasticsearch package(8.17.1) which even when upgraded refer to old libraries with Open Vulnerabilities. In our orgnaization, these vulnerabilities are flagged on a regula… --- ## [Question about malware sample distribute / sharing](https://discuss.elastic.co/t/question-about-malware-sample-distribute-sharing/378465)
**Author:** [@Mrjh0n1337](https://discuss.elastic.co/u/Mrjh0n1337)\ **Replies:** 1\ **Last updated:** [May 27, 2025, 6:03pm UTC](https://discuss.elastic.co/t/question-about-malware-sample-distribute-sharing/378465 "2025-05-27T18:03:28Z")
I'm a pentester exploring malware dev and want to setup Elastic EDR locally for testing, for the life of me i can't not find anything about detected sample getting share further analysis in Elastic documents. A friend f… --- ## [Intégration server fleet](https://discuss.elastic.co/t/integration-server-fleet/378296)
**Author:** [@rezgui](https://discuss.elastic.co/u/rezgui)\ **Replies:** 1\ **Last updated:** [May 27, 2025, 3:36pm UTC](https://discuss.elastic.co/t/integration-server-fleet/378296 "2025-05-27T15:36:44Z")
hello i have a problem with rgistery there is the error message Kibana cannot reach the Elastic Package Registry, which provides Elastic Agent integrations with curl it work well but throw kibana i had this error r… --- ## [Syscalls tapped by elastic defend](https://discuss.elastic.co/t/syscalls-tapped-by-elastic-defend/378135)
**Author:** [@Snow](https://discuss.elastic.co/u/Snow)\ **Replies:** 4\ **Last updated:** [May 27, 2025, 7:58am UTC](https://discuss.elastic.co/t/syscalls-tapped-by-elastic-defend/378135 "2025-05-27T07:58:01Z")
i could see the below list of events tapped by elastic defend, apart from this, what are the list of syscalls tapped by elastic defend? end (process event) fork (process event) exec (process event) uid\_change (proc… --- ## [The audit log integration process.args log entry only contains the user.id field; it does not contain the user.name field. Please suggest!It's urgent!](https://discuss.elastic.co/t/the-audit-log-integration-process-args-log-entry-only-contains-the-user-id-field-it-does-not-contain-the-user-name-field-please-suggest-its-urgent/374400)
**Author:** [@evangelin](https://discuss.elastic.co/u/evangelin)\ **Replies:** 8\ **Last updated:** [February 19, 2025, 7:37am UTC](https://discuss.elastic.co/t/the-audit-log-integration-process-args-log-entry-only-contains-the-user-id-field-it-does-not-contain-the-user-name-field-please-suggest-its-urgent/374400 "2025-02-19T07:37:15Z")
Hello Team, I'm using the audit integration to parse audit logs. For the audit record type USER\_CMD, the user.name field is not being mapped; only the user.id is present. The log entry contains AUID, which represents t… --- ## [Elastic Endpoint stuck "STARTING"](https://discuss.elastic.co/t/elastic-endpoint-stuck-starting/374437)
**Author:** [@pok\_lehbim](https://discuss.elastic.co/u/pok_lehbim)\ **Replies:** 3\ **Last updated:** [February 13, 2025, 3:31pm UTC](https://discuss.elastic.co/t/elastic-endpoint-stuck-starting/374437 "2025-02-13T15:31:42Z")
I set up an agent policy with a few other integrations that work fine, the only one that is causing trouble is Elastic Defend. Despite using the default configuration it is not working. Here is all I've been able to gat… --- ## [Do FIM integration can also monitor the log files?](https://discuss.elastic.co/t/do-fim-integration-can-also-monitor-the-log-files/374158)
**Author:** [@evangelin](https://discuss.elastic.co/u/evangelin)\ **Replies:** 4\ **Last updated:** [February 6, 2025, 12:44pm UTC](https://discuss.elastic.co/t/do-fim-integration-can-also-monitor-the-log-files/374158 "2025-02-06T12:44:59Z")
Hello team, I'm using the FIM integration from ELK i have added the paths like /etc/passwd , /etc/group and /var/log/dpkg.log. I'm getting getting printed if any changes observer in /etc/passwd , /etc/group But its… --- ## [Built-in CEL within Custom Threat Intelligence Integration](https://discuss.elastic.co/t/built-in-cel-within-custom-threat-intelligence-integration/373945)
**Author:** [@Akodo](https://discuss.elastic.co/u/Akodo)\ **Replies:** 2\ **Last updated:** [January 31, 2025, 5:07pm UTC](https://discuss.elastic.co/t/built-in-cel-within-custom-threat-intelligence-integration/373945 "2025-01-31T17:07:05Z")
Morning. I found this integration in pre-release, Custom Threat Intelligence, and it fits perfect into our TI feed for hashes with a Trend Micro server we have. But I'm running into an issue, where I'm getting a CEL erro… --- ## [Create Cases with Elastic Security Rule Alerts](https://discuss.elastic.co/t/create-cases-with-elastic-security-rule-alerts/373067)
**Author:** [@logalicious](https://discuss.elastic.co/u/logalicious)\ **Replies:** 2\ **Last updated:** [January 27, 2025, 1:14pm UTC](https://discuss.elastic.co/t/create-cases-with-elastic-security-rule-alerts/373067 "2025-01-27T13:14:19Z")
Is there a way to create cases automatically when specific Security Rules trigger? I see lots of integrations for third-party case management tools, but I do not see any way to integrate security rules with Elastic Cases… --- ## [53 / 5.000 Elastic defend allows all files in a directory](https://discuss.elastic.co/t/53-5-000-elastic-defend-allows-all-files-in-a-directory/373528)
**Author:** [@ArgoAdvisory](https://discuss.elastic.co/u/ArgoAdvisory)\ **Replies:** 1\ **Last updated:** [January 22, 2025, 5:40pm UTC](https://discuss.elastic.co/t/53-5-000-elastic-defend-allows-all-files-in-a-directory/373528 "2025-01-22T17:40:35Z")
Good morning everyone. I have installed Elastic Defend \\ Endpoint Security on my Windows computer. I would like every file in a specific folder: Example, C:\\directory\* not to be blocked. I have already tried to put … --- ## [Does Endgame Sensor support MacOS 15 Sequoia?](https://discuss.elastic.co/t/does-endgame-sensor-support-macos-15-sequoia/373106)
**Author:** [@SLDM](https://discuss.elastic.co/u/SLDM)\ **Replies:** 2\ **Last updated:** [January 13, 2025, 3:20pm UTC](https://discuss.elastic.co/t/does-endgame-sensor-support-macos-15-sequoia/373106 "2025-01-13T15:20:09Z")
Is the Endgame Sensor supported in MacOS 15 Sequoia? I checked the support matrix for Endgame and it hasn't been updated since 2023, so I am a bit confused. --- ## [Elastic EDR Problem](https://discuss.elastic.co/t/elastic-edr-problem/371748)
**Author:** [@Aliya\_Khalel](https://discuss.elastic.co/u/Aliya_Khalel)\ **Replies:** 1\ **Last updated:** [December 12, 2024, 6:03pm UTC](https://discuss.elastic.co/t/elastic-edr-problem/371748 "2024-12-12T18:03:01Z")
We using Fleet-managed Elastic Agent. All agents has policies have Elastic Defend integration. We are using Enteprise License. Can EDR decrease speed of downloading files from Whatsapp? Why I don't see Malware Preven… --- ## [Issues with NFS shares and mounting at startup - Linux clients](https://discuss.elastic.co/t/issues-with-nfs-shares-and-mounting-at-startup-linux-clients/370603)
**Author:** [@michael-a](https://discuss.elastic.co/u/michael-a)\ **Replies:** 5\ **Last updated:** [November 19, 2024, 8:31pm UTC](https://discuss.elastic.co/t/issues-with-nfs-shares-and-mounting-at-startup-linux-clients/370603 "2024-11-19T20:31:39Z")
We have an issue with our Linux clients running Agent v8.15.x (and have had before on earlier versions as well) where every NFS share gets mounted by the elastic agent user at time of boot - for no obvious reasons. We've… --- ## [Elastic defend with elastic instance in hetzner](https://discuss.elastic.co/t/elastic-defend-with-elastic-instance-in-hetzner/370442)
**Author:** [@Issam\_Zgybi](https://discuss.elastic.co/u/Issam_Zgybi)\ **Replies:** 1\ **Last updated:** [November 13, 2024, 9:00am UTC](https://discuss.elastic.co/t/elastic-defend-with-elastic-instance-in-hetzner/370442 "2024-11-13T09:00:47Z")
hello team, i have an elastic + kibana in a hetzner server behind pfsense, my problem is with elastic defend integration, the integration is not working! the agent apear as unhealthy, my setup is the elastic is accesibl… --- ## [What does the "user: 7 (Authentication failure)" mean?](https://discuss.elastic.co/t/what-does-the-user-7-authentication-failure-mean/369242)
**Author:** [@just4bs](https://discuss.elastic.co/u/just4bs)\ **Replies:** 0\ **Last updated:** [October 22, 2024, 5:15pm UTC](https://discuss.elastic.co/t/what-does-the-user-7-authentication-failure-mean/369242 "2024-10-22T17:15:27Z")
Came across this in an alert. What does the 7 mean here? Is there a list of codes that include other numbers? Thanks --- ## [Issue monitoring registry key using elastic agent (File Integrity Monitoring integration)](https://discuss.elastic.co/t/issue-monitoring-registry-key-using-elastic-agent-file-integrity-monitoring-integration/369086)
**Author:** [@ganrt](https://discuss.elastic.co/u/ganrt)\ **Replies:** 1\ **Last updated:** [October 18, 2024, 10:16pm UTC](https://discuss.elastic.co/t/issue-monitoring-registry-key-using-elastic-agent-file-integrity-monitoring-integration/369086 "2024-10-18T22:16:36Z")
Hello. Recently a deploy elastic stack with elastic agent and it seem to be no monitoring registry key, however if I place a folder directory it works file, however not with registry key path, any suggestion what to mo… --- ## [Questions about Auditd Manager](https://discuss.elastic.co/t/questions-about-auditd-manager/368091)
**Author:** [@KungFuLastic](https://discuss.elastic.co/u/KungFuLastic)\ **Replies:** 2\ **Last updated:** [October 2, 2024, 5:57am UTC](https://discuss.elastic.co/t/questions-about-auditd-manager/368091 "2024-10-02T05:57:29Z")
Hi, a question on Auditd Manager Integration after reading the Overview: so it acts similarly to auditd service which reads and saves audit info from the kernel but instead of saving it to disk; it sends it to elastic. … --- ## [Elastic Defend Licensing](https://discuss.elastic.co/t/elastic-defend-licensing/366405)
**Author:** [@mike123](https://discuss.elastic.co/u/mike123)\ **Replies:** 3\ **Last updated:** [September 12, 2024, 3:45am UTC](https://discuss.elastic.co/t/elastic-defend-licensing/366405 "2024-09-12T03:45:53Z")
Hi team, We are analyzing Elastic stack for our security needs. we are testing Elastic defend for forwarding logs. After the Elastic Agent is installed with the Elastic Defend integration, several protections features —… --- ## [Slow Event Analyzer queries](https://discuss.elastic.co/t/slow-event-analyzer-queries/365933)
**Author:** [@lduvnjak](https://discuss.elastic.co/u/lduvnjak)\ **Replies:** 3\ **Last updated:** [September 10, 2024, 2:04pm UTC](https://discuss.elastic.co/t/slow-event-analyzer-queries/365933 "2024-09-10T14:04:48Z")
Hey Everyone, I'm having some issues with the Event Analyzer for Elastic Defender rules. They are extremely slow and time out quite often. With the default elasticsearch.requestTimeout set to 30000 almost all of them … --- ## [Elastic Endpoint (Defend) does not seem to report file hashes for writes or modifications](https://discuss.elastic.co/t/elastic-endpoint-defend-does-not-seem-to-report-file-hashes-for-writes-or-modifications/365785)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 7\ **Last updated:** [September 3, 2024, 2:05pm UTC](https://discuss.elastic.co/t/elastic-endpoint-defend-does-not-seem-to-report-file-hashes-for-writes-or-modifications/365785 "2024-09-03T14:05:32Z")
Hey all, this is similar to: Endpoint events dont contain process or file hash When I look at fields in the endpoint\* datasets, the fields file.hash.\* are not populated. I see process.hash.\* on events in the dataset en… --- ## [Installing Elastic Agent with GPO](https://discuss.elastic.co/t/installing-elastic-agent-with-gpo/364659)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 13\ **Last updated:** [August 22, 2024, 12:03pm UTC](https://discuss.elastic.co/t/installing-elastic-agent-with-gpo/364659 "2024-08-22T12:03:35Z")
Im looking to deploy Elastic Agent via a GPO. What is the best way to do it? It should autoenroll onto Fleet without any manual token needed --- ## [Defend exclusion by parent signature?](https://discuss.elastic.co/t/defend-exclusion-by-parent-signature/365075)
**Author:** [@FranklinFurter](https://discuss.elastic.co/u/FranklinFurter)\ **Replies:** 3\ **Last updated:** [August 19, 2024, 7:19pm UTC](https://discuss.elastic.co/t/defend-exclusion-by-parent-signature/365075 "2024-08-19T19:19:53Z")
I recently ran into an issue where Defend is triggering on suspicious activity. Unfortunately, the suspicious activity is due to a legitimate software install that is adding itself to the windows defender exclusions dire… --- ## [Elastic Defend backward compatibility](https://discuss.elastic.co/t/elastic-defend-backward-compatibility/364144)
**Author:** [@daniel-san](https://discuss.elastic.co/u/daniel-san)\ **Replies:** 6\ **Last updated:** [August 5, 2024, 6:23am UTC](https://discuss.elastic.co/t/elastic-defend-backward-compatibility/364144 "2024-08-05T06:23:46Z")
Hello there, recently i've digged through the available elastic compatibility matrix and cant find any related informations. Question/Example: Is Elastic Defend Version 8.14.x compatible with lets say Elastic Agent 8.… --- ## [ES|QL - span](https://discuss.elastic.co/t/es-ql-span/364021)
**Author:** [@Marek\_Galbavy](https://discuss.elastic.co/u/Marek_Galbavy)\ **Replies:** 4\ **Last updated:** [July 30, 2024, 6:33am UTC](https://discuss.elastic.co/t/es-ql-span/364021 "2024-07-30T06:33:10Z")
Hi i create a new topic as a advice of your team: I want to create a rule that will detect the upload of a large amount of data from my network. The rule works as I want, except that I have to run it every minute to gro… --- ## [Host an air-gapped Elastic Endpoint artifact server](https://discuss.elastic.co/t/host-an-air-gapped-elastic-endpoint-artifact-server/363870)
**Author:** [@devilman85](https://discuss.elastic.co/u/devilman85)\ **Replies:** 7\ **Last updated:** [July 29, 2024, 6:54am UTC](https://discuss.elastic.co/t/host-an-air-gapped-elastic-endpoint-artifact-server/363870 "2024-07-29T06:54:59Z")
I have followed the official guide in the subject does not update the signatures despite creating the ngnix server for the files. How can I solve this? --- ## [Disable HTTP OPTIONS on port 9200](https://discuss.elastic.co/t/disable-http-options-on-port-9200/363824)
**Author:** [@bhupendra.mskhatri](https://discuss.elastic.co/u/bhupendra.mskhatri)\ **Replies:** 6\ **Last updated:** [July 29, 2024, 4:16am UTC](https://discuss.elastic.co/t/disable-http-options-on-port-9200/363824 "2024-07-29T04:16:02Z")
How to disable HTTP OPTIONS on port 9200 which our scan tool is flagging as a vulnerability. If we cannot, could you please share a reason that I could share with my security team (link to a document would be prefarable… --- ## [Information about the endpoint.metrics dataset](https://discuss.elastic.co/t/information-about-the-endpoint-metrics-dataset/363873)
**Author:** [@popeio](https://discuss.elastic.co/u/popeio)\ **Replies:** 0\ **Last updated:** [July 26, 2024, 3:23pm UTC](https://discuss.elastic.co/t/information-about-the-endpoint-metrics-dataset/363873 "2024-07-26T15:23:28Z")
Hello there, Recently we've begun tinkering with a peculiar dataset named endpoint.metrics, which reports a number of performance metrics once a day (it seems) and upon every policy change. For what it's worth, we are … [Previous page](https://discuss.elastic.co/c/security/endpoint-security/80.md) [Next page](https://discuss.elastic.co/c/security/endpoint-security/80.md?page=2)