The SIEM app is now a part of the Elastic Security solution.
Click
here to view SIEM documentation for previous releases.
Elastic Endpoint Securityedit
Generates a detection alert each time an Elastic Endpoint alert is received. Enabling this rule allows you to immediately begin investigating your Elastic Endpoint alerts.
Rule type: query
Rule indices:
- logs-endpoint.alerts-*
Severity: medium
Risk score: 47
Runs every: 5 minutes
Searches indices from: now-10m (Date Math format, see also Additional look-back time)
Maximum alerts per execution: 10000
Tags:
- Elastic
- Endpoint
Version: 1
Added (Elastic Stack release): 7.9.0
Rule authors: Elastic
Rule license: Elastic License
Rule queryedit
event.kind:alert and event.module:(endpoint and not endgame)