SIEM Overview Page : Modify Security Settings Kibana

Elastic Security SIEM
1

Hi I have created two spaces in Kibana : a.) Default b.) Saurabh

In saurabh space , i tried to open SIEM overview page , it opened properly.
Now we have a link here to modify(enable/disable) security settings in kibana (In the news feed , if no news available.)

This link is always pointing out to default space ie
/app/kibana#/management/kibana/settings

while ideally it should be

/s/saurabh/app/kibana#/management/kibana/settings

Can anybody help me on this . Do i need to configure this anywhere or is it a bug ?

2

Hi Saurabh,

I think I am missing something because I tried what you were describing. I created two spaces a- Default b- xavier-space. I left the default space alone (meaning I did not change anything), then I login to xavier-space and went to kibana advance settings and I picked the category SIEM. Under this category and I was able to change the new feeds URL for this space. At the end I was able to change between these two spaces and see that the settings were different on my SIEM overview page.

Like I said at the beginning, I am thinking that I am missing something, therefore if you can give more information that will be appreciated.

Best,
Xavier

1 Like
3

Hey @Xavier_Mouligneau thanks ,
so in the kibana advance setting(Xavier space) : SIEM category , add a url for which you don't get any feed . Example add "http://google.com".

Now open SIEM overview page Xavier space , at the left side of page , you would see message , that security URL is not giving any feed. Kindly go and disable in security advance setting[link]. Now observe this link, this link is point towards the default space.(/app/kibana#/management/kibana/settings)

ideally it should point to Xavier space.
/s/xavier/app/kibana#/management/kibana/settings

4

Got it!!!, yes that's a bug. Thanks, do you want me to create an issue or are you willing to do it?

1 Like
5

I will create a bug @Xavier_Mouligneau. Thank you for the confirmation.

Cheers

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.