SIEM - troubleshooting various error

[Frank_Hassanabad]

Your winlogbeat mappings aren't installed properly probably. See this thread for troubleshooting steps:

SIEM doesn't show any Winlogbeat events, despite ES receiving them

Hi @aura, as you've discovered, it seems that some of your fields are not being mapped to the correct Elasticsearch datatypes. Elastic Common Schema (ECS) specifies that fields such as host.name must be of the keyword datatype. Indeed, as you've also discovered, Elastic SIEM relies specifically on host.name to be present as a condition for populating many visualizations with host data. I'm not sure how familiar you are with Elasticsearch mapping and index templates, as they can be challenging…