# SIEM doesn't display data but welcome page

**URL:** <https://discuss.elastic.co/t/siem-doesnt-display-data-but-welcome-page/297797>\
**Category:** Elastic Security\
**Tags:** docker\
**Created:** [February 21, 2022, 5:34pm UTC](https://discuss.elastic.co/t/siem-doesnt-display-data-but-welcome-page/297797 "2022-02-21T17:34:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![luis\_corral](https://avatars.discourse-cdn.com/v4/letter/l/c37758/32.png) [@luis\_corral](https://discuss.elastic.co/u/luis_corral)\
**Post date:** [February 21, 2022, 5:34pm UTC](https://discuss.elastic.co/t/siem-doesnt-display-data-but-welcome-page/297797/1 "2022-02-21T17:34:46Z")

</div>

Hi all,

We have implemented an instance of Elastic SIEM in our environment, and we're already receiving data on it that we can see in Kibana's tab, but if going to Security tab, only displays the welcome page to add agents (which aren't really needed at this point as we already have data we would like to show there)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/6/66ba4046c0ebc61bd9ebf398a8c5aee3457fe721.jpeg)

If I go to Kibana tab/options I can see the data received, but not in the Security tabs/options

Using Stack Management 7.16.3

Thanks in advance

---

<div class="post-metadata">

**Author:** ![Nikita\_Khristinin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikita_khristinin/32/102092_2.png) [@Nikita\_Khristinin](https://discuss.elastic.co/u/Nikita_Khristinin)\
**Post date:** [February 21, 2022, 7:41pm UTC](https://discuss.elastic.co/t/siem-doesnt-display-data-but-welcome-page/297797/2 "2022-02-21T19:41:27Z")

</div>

Hey, which indexes had data?

As I understand it's looking for data in `securitySolution:defaultIndex`  
By default it's "apm-_-transaction_, traces-apm\*, auditbeat-_, endgame-_, filebeat-_, logs-_, packetbeat-_, winlogbeat-_"

You can also change this value in Advanced Settings.

---

<div class="post-metadata">

**Author:** ![luis\_corral](https://avatars.discourse-cdn.com/v4/letter/l/c37758/32.png) [@luis\_corral](https://discuss.elastic.co/u/luis_corral)\
**Post date:** [February 22, 2022, 5:08am UTC](https://discuss.elastic.co/t/siem-doesnt-display-data-but-welcome-page/297797/3 "2022-02-22T05:08:04Z")

</div>

Awesome, thank you so much for your reply!  
Thank to that I was able to include the index where we have all the info stored as it wasn't the default ones.

Additional detail for someone else looking at this and could be helpful  
Location of the field mentioned by Nikita, going by GUI:  
Management \> Kibana \> Advanced Settings \> Security Solution \> Elasticsearch indices

Best Regards

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 22, 2022, 5:08am UTC](https://discuss.elastic.co/t/siem-doesnt-display-data-but-welcome-page/297797/4 "2022-03-22T05:08:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.