Error activating rule

Elastic Security
1

Hi there,

We have faced the issue when activated the rule and the appear this Error
Alert type siem.signals is disabled because your basic license has expired
My version ELK: 7.17.8
Basic license

can you hlep me ?

2

Hi @saudmajed99 , welcome to Elastic community!

I suspect your basic license might not be active at the moment.

Can you please run this API call Get license API | Elasticsearch Guide [7.17] | Elastic and check the status of the license.

Here is an example response from that API call

{
  "license" : {
    "status" : "active",
    "uid" : "cbff45e7-c553-41f7-ae4f-9205eabd80xx",
    "type" : "trial",
    "issue_date" : "2018-10-20T22:05:12.332Z",
    "issue_date_in_millis" : 1540073112332,
    "expiry_date" : "2018-11-19T22:05:12.332Z",
    "expiry_date_in_millis" : 1542665112332,
    "max_nodes" : 1000,
    "issued_to" : "test",
    "issuer" : "elasticsearch",
    "start_date_in_millis" : -1
  }
}

Please, do not share here any sensitive information(issued, uid, etc). Just let us know what the status and type properties are from that response.

If it happen, status is not active and type is "basic" you can try to run this API: Get basic status API | Elasticsearch Guide [7.17] | Elastic

And after try to start basic license by using this API: Start basic API | Elasticsearch Guide [7.17] | Elastic, as I was advised by relevant team.

I hope, that would help to resolve your issue
Thanks, Vitalii

3

Hi vitalii

How to check license from server ELK

4

you can run queries either in Kibana dev console Run Elasticsearch API requests | Kibana Guide [7.17] | Elastic

or copy query as curl from API page

Screenshot 2023-08-15 at 14.17.59
Screenshot 2023-08-15 at 14.17.591818×458 30.1 KB

It will target ES host. You will need just put there through setting correct url and username or edit it manually

5

Ok, I did result not active then used this command

GET /_license/basic_status

response: "eligible_to_start_basic" : false

can you help me the solve issue

6

It looks like something very strange is going on with your cluster's license

Can you provide the details from the GET /_license API call that @vitaliidm directed you to?

We need to see the actual response in order to be able to recommend next steps.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.