Detections will not setup

Elastic Security SIEM
1

Hello,

i have a problem with setup detections in SIEM. I always get a message with Let's set up your detection engine.

I have logged in as a superuser
i cannot see the .siem-signals index.

I have check the role i have api management role and access to the siem space with create righs.

2

Hi @xennn,

So it sounds like you are using on prem install? Our cloud based one is the simplest setup for trying out detection engine if you're just getting your started and want to play with it as it doesn't really require much setup to be honest. [1]

However, if you want to setup and run on prem following this set of steps is the simplest:
https://www.elastic.co/guide/en/siem/guide/current/detection-engine-overview.html#detections-permissions

If you have already followed those steps but are still getting the same screen and just want more in depth trouble shooting because maybe you have a really involved on prem large custom setup and you're one of those in-depth geeky type of people :wink: you can open your dev tools from Chrome and look for this in your network tab [2]:

network_panel
network_panel2840×2046 714 KB

You can then see which part of the trouble shooting guide is still not satisfied. There have been some rare reports of large installations of on prem or corner cases involving reverse proxies that have been preventing detection engine from running but those have been rare and far inbetween. Most of the times it's just something missing from the checklist listed on our website.

[1] https://www.elastic.co/elasticsearch/service
[2] https://developers.google.com/web/tools/chrome-devtools/open

3

Hello Frank,

thank you for your feedback. This is a really helpful to check / debug the permissions.
You are right, i have a elastic on prem setup as a cluster. Its for my company.
I have check what you tell me, but the permissions looks good.But i notice the encryption key part. I have one in my config, but i check it again.
Thank you very much!

grafik
grafik945×1080 57.2 KB

grafik
grafik905×846 42.8 KB

4

It work now. I have in Kibana.yml forget
xpack.encryptedSavedObjects.encryptionKey:
i allready have
xpack.security.encryptionKey:

Thank you!

5

YEA!

What an awesome Friday treat. Thanks for letting me know this solved it. Nothing makes me happier.

Happy detecting!

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.