SIEM detection engine is not getting started

Elastic Security SIEM
,
8

Hmm ok, you seem to be running into issues with the creation and access of the signals index. I know you've likely already run through these things a number of times, but just to confirm:

  • HTTPS is configured

  • In elasticsearch.yml, the following is set to true, xpack.security.enabled

  • In kibana.yml the xpack.encryptedSavedObjects.encryptionKey is set to any alphanumeric value of 32+ charachters

  • Your Kibana space has All privileges

  • Try adding create, create_doc, write, index, all, create_index privileges for .siem-signals-*

1 Like