|
Looking for a list of "Out of the Box" Use Cases for Elastic SIEM
|
|
1
|
2619
|
September 13, 2021
|
|
Fortigate Integrations
|
|
8
|
1234
|
September 12, 2024
|
|
[ Threshold Rule ]: Unexpected result
|
|
5
|
477
|
January 14, 2021
|
|
Filebeat module's fields in SIEM columns
|
|
1
|
464
|
March 5, 2021
|
|
Fortinet.tmp.*
|
|
8
|
1218
|
March 17, 2021
|
|
Kibana SIEM "External Alert"
|
|
3
|
1820
|
March 19, 2020
|
|
Alerts on SIEM
|
|
2
|
659
|
December 27, 2022
|
|
Kibana SIEM Function: Failed to Parse Date field? (Epoch Time)
|
|
8
|
1200
|
July 28, 2020
|
|
Soar in elastic
|
|
4
|
1600
|
June 27, 2023
|
|
Alert Variables in email action - EQL
|
|
3
|
1005
|
February 22, 2021
|
|
Detection rule for password spraying attempts
|
|
2
|
2057
|
November 26, 2020
|
|
Kibana Cases Analytics
|
|
5
|
1452
|
February 23, 2021
|
|
Failed to installed pre-packaged rules from elastic
|
|
3
|
1772
|
February 13, 2020
|
|
Exporting rules to ndjson generates incomplete file
|
|
4
|
887
|
November 9, 2022
|
|
Auditbeat OSS fails to start
|
|
2
|
1976
|
June 10, 2020
|
|
Indicator Match Rule Fails with too_many_nested_clauses
|
|
4
|
1525
|
July 12, 2022
|
|
Kibana SIEM display problem just spinning no error
|
|
7
|
1197
|
April 22, 2020
|
|
Signal Field Schema Documentation
|
|
0
|
600
|
June 3, 2021
|
|
SonicWall Firewall and SIEM or SNMP
|
|
1
|
2363
|
September 15, 2019
|
|
Refer to value lists in ES|QL?
|
|
1
|
236
|
April 17, 2026
|
|
TheHIVE integration for SIEM Case Management
|
|
1
|
2336
|
November 29, 2019
|
|
Autonomous System Number (ASN) not displaying
|
|
3
|
1642
|
November 1, 2019
|
|
Determine the user that acknowledged an Alert
|
|
5
|
750
|
December 21, 2023
|
|
An ECS compliant Kibana index pattern must be configured to view event data on the map
|
|
4
|
1444
|
December 5, 2019
|
|
Wazuh SIEM + Winlogbeat
|
|
2
|
1859
|
January 7, 2022
|
|
Fielddata is disabled
|
|
6
|
1211
|
November 28, 2019
|
|
Sum of source bytes seems impossibly large
|
|
6
|
1209
|
March 26, 2020
|
|
Sysmon v.11 and new 'file delete' event without archive
|
|
3
|
1582
|
June 11, 2020
|
|
Get events of an specific rule
|
|
3
|
497
|
May 6, 2022
|
|
Extraction Elastic SIEM security events
|
|
5
|
1266
|
November 18, 2020
|
|
In Ubuntu 18.04 auditbeat logs goes to syslog than /var/log/auditbeat
|
|
3
|
1493
|
November 13, 2019
|
|
Elastic Integration with Zscaler NSS service
|
|
1
|
2089
|
January 18, 2020
|
|
Detections will not setup
|
|
4
|
1320
|
April 10, 2020
|
|
Index/API end point to edit detection rules?
|
|
1
|
658
|
March 8, 2021
|
|
SIEM not ingesting Forwarded Windows logs
|
|
5
|
1193
|
November 14, 2019
|
|
Alerting with actions in SIEM Detection Rules
|
|
3
|
818
|
March 6, 2020
|
|
Failed to fetch rules and timelines: Failed to parse field [filter]: x_content_parse_exception
|
|
2
|
1672
|
April 29, 2021
|
|
SIEM -- Event Columns (Only Default Category)
|
|
8
|
954
|
June 1, 2020
|
|
How many swap files are created when you update a text file
|
|
8
|
952
|
September 26, 2019
|
|
Integrate Events into Elastic SIEM
|
|
4
|
1273
|
March 22, 2020
|
|
Detections - Kibana
|
|
7
|
1004
|
June 13, 2021
|
|
Jira Action sending broken links on detection jobs
|
|
1
|
629
|
April 1, 2021
|
|
Remove Ingest Processor
|
|
0
|
494
|
May 3, 2022
|
|
Unusual Parent-Child Relationship Query and process parent hyphen value
|
|
3
|
1380
|
December 14, 2020
|
|
Alerts dont match time on server
|
|
2
|
1575
|
August 20, 2021
|
|
Add Another Reputation Link into Kibana SIEM
|
|
1
|
1083
|
November 13, 2019
|
|
Elastic Agent 8.0.0 on macOS 12.x
|
|
3
|
1355
|
March 3, 2022
|
|
Auditbeat file integrity monitoring does not show user who made changes to file
|
|
4
|
1209
|
July 16, 2019
|
|
Turn on Anonymous access
|
|
4
|
1202
|
October 3, 2023
|
|
Timeline Template not applied when Alert fires
|
|
8
|
893
|
April 12, 2022
|