|
Using security analytics is hard mostly because of a lack of documentation
|
|
41
|
2799
|
September 21, 2024
|
|
Trouble with mappings, detectors, and alerts
|
|
22
|
1393
|
October 20, 2025
|
|
Security Analytics Error
|
|
14
|
1627
|
November 7, 2023
|
|
Mapping API / index pattern
|
|
9
|
1140
|
June 4, 2023
|
|
Detector with Linux System Logs Type does not detect its rule
|
|
12
|
288
|
September 29, 2024
|
|
User feedback on security analytics updates
|
|
1
|
589
|
October 17, 2023
|
|
Cannot delete detectors
|
|
8
|
1099
|
July 31, 2023
|
|
Security Analytics error when using Datastreams
|
|
7
|
1005
|
September 29, 2024
|
|
What shippers should I use to collect the logs so that SIGMA rules will start matching?
|
|
5
|
1023
|
October 17, 2023
|
|
Detector fields mapping issues for OpenSearch v2.5
|
|
4
|
1073
|
January 5, 2024
|
|
Failed to create query: Inconsistency of field data structures across documents for field
|
|
5
|
957
|
July 9, 2023
|
|
How to find track_total_hits value for a specific point_in_time (pit_id)?
|
|
3
|
1042
|
November 20, 2023
|
|
What log sources do you need for Security Analytics
|
|
5
|
789
|
June 20, 2023
|
|
"null cannot be cast to non-null type" creating a detector
|
|
8
|
614
|
December 8, 2024
|
|
Customizing Alert Security Analytics
|
|
7
|
647
|
December 26, 2023
|
|
Exception creating detector
|
|
6
|
677
|
May 26, 2023
|
|
How to make security Analytics Rule Detection
|
|
4
|
777
|
August 12, 2023
|
|
Failed to start Document-level-monitor: Inconsistency of field data structures across documents for field
|
|
4
|
750
|
May 28, 2023
|
|
Error creating custom rules through the Rule API
|
|
2
|
754
|
January 9, 2024
|
|
Issue with Scheduled job for detectors
|
|
5
|
519
|
August 1, 2023
|
|
Mappings in Security Analytics Plugin
|
|
3
|
622
|
May 15, 2023
|
|
Security Analytics not working for Cross-cluster search
|
|
5
|
496
|
December 24, 2023
|
|
[OpenSearch] Multi-tenancy support in security analytics detector
|
|
3
|
595
|
April 28, 2023
|
|
Winlogbeat + security module analytics: data growup
|
|
2
|
683
|
August 19, 2023
|
|
Is there a new Mapping for Windows Logs in v2.9 breaking ECS?
|
|
3
|
591
|
October 31, 2023
|
|
DNS SAP monitor throws error on create
|
|
8
|
390
|
July 7, 2023
|
|
Detectors in Security Analytics Plugin
|
|
5
|
425
|
June 4, 2023
|
|
Define OR instead of AND
|
|
4
|
435
|
July 30, 2024
|
|
Security analytics - not able create detector
|
|
3
|
414
|
July 10, 2024
|
|
Security Analytics for DNS logs
|
|
1
|
521
|
September 10, 2023
|
|
How to schedule correlation rules?
|
|
1
|
483
|
July 9, 2023
|
|
Create detectors on datastream
|
|
4
|
303
|
February 14, 2024
|
|
Importing Sigma Rule results into Error Message
|
|
2
|
384
|
March 3, 2023
|
|
Security Analytics Receive Alerts from Alerting Plugin
|
|
3
|
331
|
July 3, 2023
|
|
Detectors with custom rules are not producing any findings or alerts
|
|
1
|
456
|
May 29, 2023
|
|
Security Analytics detector not consistently generating Findings
|
|
1
|
423
|
November 11, 2023
|
|
Security Analytics - doesn't work, no rules
|
|
2
|
341
|
July 7, 2024
|
|
Monitor can't process index [filebeat] due to field mapping limit
|
|
2
|
336
|
April 30, 2023
|
|
Security Analytics detector not consistently generating Findings
|
|
1
|
356
|
November 12, 2023
|
|
Unable to get alert - getting Error and Deleted state
|
|
1
|
353
|
April 30, 2024
|
|
Security Analytics only alerting at 12am UTC
|
|
5
|
202
|
August 3, 2024
|
|
Has anyone ever created a detector based on a custom log type?
|
|
1
|
325
|
June 2, 2024
|
|
[security_analytics_exception] class java.lang.String cannot be cast to class java.util.Map (java.lang.String and java.util.Map are in module java.base of loader 'bootstrap')
|
|
1
|
315
|
June 15, 2024
|
|
Issues with Security Analytics and indexes/shards
|
|
1
|
312
|
December 16, 2023
|
|
Use a wmi's detection rule
|
|
1
|
290
|
July 30, 2023
|
|
Using Anomaly Detection Plugin to Identify External IP Log Entries
|
|
6
|
149
|
September 24, 2024
|
|
Best practices for daily-roated-indexes
|
|
3
|
186
|
April 27, 2025
|
|
Need help for create Opensearch correlation rule for detect brute force attack
|
|
3
|
178
|
May 30, 2025
|
|
Select pattern instead of an index
|
|
2
|
202
|
July 26, 2024
|
|
Cannot able to call localhost webhook via notification channels
|
|
8
|
116
|
January 2, 2026
|