Empty column "Last failed source"

[NogNeetMachinaal (Will Moonen)]

See also attached screenshot:
I would expect IP-adresses in the column "Last failed source". This expectations is based on the timestamp in the column "Last failure".

Since this is not the case: what would it take to make that happen?

I'm running ES with Kibana version 7.6.1.; including the respective Auditbeat and Packetbeat shippers.

[Marius_Dragomir]

Hi, this is a question more about the data collection than Kibana (which only displays what data there is in ES).
You should try asking this in the Beats sub-forum.

[NogNeetMachinaal (Will Moonen)]

Thank you for the response Marius.

While a valid possibility in itself, it is not the case here.

The data seems to be there - I have checked this with Discovery on the index Auditbeat => this is the data source for this part.

However, I'm not aware of something that can be used for a crosscheck => is Kibana reading from the same tables as Auditbeat is writing to.

I have a similar issue with Packetbeat and TLS: there seems to be a mismatch in the datascheme.

[Marius_Dragomir]

Ah, I just realized now that you are in the SIEM app. I apologize, at first sight it seemed like a table created in Discover. It might be the same issue, I'll ping the SIEM team about it.

[NogNeetMachinaal (Will Moonen)]

Thanks Marius.
Let me know if there is anything I can do to help.