|
Firewall logs to different Datastream by type
|
|
22
|
489
|
April 24, 2025
|
|
Threat Intel and SIEM
|
|
2
|
4488
|
November 17, 2020
|
|
Elastic SIEM TheHive Integration
|
|
1
|
2571
|
August 10, 2021
|
|
[ Creating new rule ]: ERROR Authentication using apikey failed - api key has been invalidated
|
|
4
|
9606
|
January 19, 2021
|
|
Palo Alto [SIEM]
|
|
2
|
743
|
June 19, 2020
|
|
Best way to analyze Event Correlation Sequence detections
|
|
5
|
2471
|
December 7, 2022
|
|
SIgma rules for Elastic SIEM
|
|
4
|
13361
|
April 3, 2021
|
|
Detecting inactive users in Active Directory
|
|
5
|
1834
|
January 25, 2023
|
|
Active Directory logs and mapping to ECS (I am stumped)
|
|
6
|
8775
|
October 14, 2019
|
|
Creating a case for an alert automatically
|
|
2
|
1706
|
January 27, 2022
|
|
Limit CPU/Memory usage in Auditbeat & Filebeats , version 7.9.0
|
|
7
|
5455
|
September 17, 2020
|
|
Multiple Different Clients
|
|
4
|
2090
|
January 4, 2021
|
|
Event Correlation on ELK
|
|
2
|
8004
|
August 26, 2019
|
|
Can I still use Threat Intelligence?
|
|
6
|
835
|
November 29, 2022
|
|
Feature Request for more robust vector graphics (Vega not enough) so I can generate good looking network maps (non-geographic)
|
|
2
|
635
|
March 23, 2023
|
|
Import rules from public detection rules repo
|
|
2
|
1974
|
August 18, 2020
|
|
Seperate email alerts per detection?
|
|
2
|
581
|
May 17, 2022
|
|
Hosts table : host.name (alias of beat.name) used instead of agent.hostname
|
|
1
|
3992
|
February 17, 2020
|
|
Fleet server agent unable to start- Connection refused
|
|
3
|
4704
|
October 7, 2021
|
|
"Machine learning permission error" for demo user
|
|
1
|
1168
|
June 25, 2020
|
|
Hosts duplicated with and without fqdn
|
|
6
|
1957
|
June 30, 2020
|
|
Filebeat for Sophos XG Firewall
|
|
8
|
3059
|
August 7, 2019
|
|
SIEM ECS descriptions taking huge amount of unneccesary space in SIEM
|
|
1
|
625
|
September 27, 2019
|
|
Config alerts and actions email connector
|
|
7
|
2941
|
September 24, 2020
|
|
SOAR for elk
|
|
2
|
4668
|
April 16, 2020
|
|
SIEM feature request
|
|
4
|
635
|
October 1, 2020
|
|
Aggregation support in SIEM
|
|
2
|
810
|
June 23, 2020
|
|
Alert when an event is not followed by another
|
|
6
|
929
|
September 26, 2022
|
|
How to define time range in custom query rule in elasticsiem?
|
|
5
|
1781
|
March 23, 2021
|
|
WHAT SIEM CAN DO?
|
|
3
|
1208
|
August 13, 2020
|
|
Bulk indexing of signals failed in Kibana 7.10.2
|
|
7
|
2687
|
January 29, 2021
|
|
Building block rules/use case
|
|
7
|
2649
|
November 10, 2020
|
|
Sending the alert JSON details using Webhook Connector
|
|
7
|
1488
|
April 11, 2024
|
|
Unifi Ubiquity USG IPS Suricata Filebeat Logging
|
|
2
|
1363
|
May 14, 2020
|
|
Signal - multiple login failure from same user
|
|
1
|
1668
|
November 16, 2020
|
|
Detection rule: Failed login attempts
|
|
2
|
4026
|
June 2, 2021
|
|
Host not showing up despite events being present
|
|
8
|
2311
|
March 13, 2020
|
|
SIEM Threshold - unique values
|
|
5
|
1561
|
September 1, 2020
|
|
Feedback on the Security Solution Dashboard Experience
|
|
6
|
256
|
June 15, 2026
|
|
Security rules failing (timed out) all the time
|
|
5
|
2754
|
November 1, 2021
|
|
Creating a rule exception
|
|
1
|
1502
|
July 21, 2022
|
|
Another Feature Request for SIEM
|
|
5
|
864
|
July 8, 2020
|
|
"path: /_security/api_key... api keys are not enabled" while loading prebuilt detection rules
|
|
3
|
3330
|
February 16, 2020
|
|
Graylog logs directed to Elastic SIEM
|
|
5
|
2700
|
June 1, 2020
|
|
Shards failed warning on Network dashboard in SIEM app
|
|
8
|
2164
|
March 3, 2020
|
|
How to create a rule with aggregation
|
|
4
|
2851
|
April 6, 2021
|
|
Elastic SIEM for MSSP
|
|
6
|
2403
|
June 11, 2020
|
|
Shodan Integration
|
|
4
|
2774
|
April 1, 2020
|
|
Run Elastic detection rule in non real time logs
|
|
1
|
779
|
September 11, 2021
|
|
Adding Fleet Server failed because “x509: certificate signed by unknown authority“
|
|
5
|
2509
|
January 30, 2023
|