Hi All, Just started to play around with SIEM. When opening the menu, we are constantly presented with this error. The only logs we are ingesting is our building security logs, and I have manually created logstash filters for this. All events are tied to fields founds in the ECS. Is there a way we…

Depends on what you're doing. If you're writing your own downstream agent/beat/script that is going to parse logs and push it as ECS you can use existing tools from the ECS repo here: [image] elastic/ecs Elastic Common Schema. Contribute to elastic/ecs development by creating an account …

Visualizations has errors default page

Elastic Security SIEM

Frank_Hassanabad (Frank Hassanabad) August 17, 2020, 7:35pm 3

Yeah this often happens if you haven't pushed your index templates and you can see us answering this here with some pointers on what to do:

I don't know if it's your winlogbeat, audtibeat, some custom one, etc... but usually if you can get your templates and ECS mapping pushed up and then do a reindex, data reset, you will be ok.