Hi all! I have an issue with the Elastic Security Rules. I've installed the elastic agents on my target instances: [Screenshot 2021-11-24 at 19.18.14] I can successfully see its data streams: [Screenshot 2021-11-24 at 19.21.42] I've created default enrolment policy for my agents: [Screensh…

Hey @Dmitriy_Esin looks like the issues is that the rule isn't seeing data within the index patterns auditbeat-* or logs-endpoint.events.*. Could you check the Stack Management -> Index Management page, enable hidden indices, and then search for auditbeat or events and see if anything comes up that …

Hey @Dmitriy_Esin thanks for the question! If you click on the Rule Monitoring tab within Rules, does it show any error messages relating to the prebuilt rules? Could you also provide some Kibana logs? The Detection Rules should log some warnings and errors if they're running into problems.

Hi @Jonathan_Buttner thanks for you reply! Here is the example screenshot of the the prebuilt rule: [Screenshot 2021-11-25 at 11.39.23] I have specific warnings in each prebuilt rule. Unfortunately I can't find any logs from Kibana in web UI (elastic stack is in kubernetes), but I've found cont…

Here is nothing to configure [Screenshot 2021-11-29 at 17.08.51]

Hi @Jonathan_Buttner ! Yes, unfortunately, I've tried it, but there are no indices that we need [Screenshot 2021-11-29 at 21.31.06] [Screenshot 2021-11-29 at 21.31.01]

I know that agents create indices themselves when we use any integration, but there is no Prebuilt Security Rules integration in my elastic-agent.yml and I can't configure it :frowning:

thank you for your answer! I'll try to install auditbeat.

Thank you so much!!! You saved me! It works well now!

@Jonathan_Buttner one more question from me: All rules are well, and I'm very grateful to you for your assistance, but one rule has a status "warning" [Screenshot 2021-11-29 at 22.29.24] Can I kindly ask you to help to understand how to resolve it?

I'm glad you got it working! The warnings about the event.ingested are indicating that auditbeat and elastic agent aren't populating the event.ingested field. While it's ideal to have this field populated it's not required. The detection rules will fallback to using the @timestamp field instead. You…

Discuss the Elastic Stack

Elastic SIEM. Security rules doesn't work

Elastic Security SIEM

Dmitriy_Esin (Dmitriy Esin) November 29, 2021, 2:09pm 5

Here is nothing to configure

Topic		Replies	Views
ElasticSIEM unable to find [logs-endpoint.alerts SIEM	12	4334	August 18, 2021
All Rules are showing Failed Elastic Security	29	6008	March 25, 2021
SIEM detection rule Elastic Security detection-rules	2	130	February 6, 2025
Error with Security Rules Elastic Security elastic-stack-alerting	9	2317	June 20, 2022
SIEM prebuilt rules SIEM	3	831	June 30, 2021

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Elastic SIEM. Security rules doesn't work

Related topics