# Alert when an event is not followed by another **URL:** \ **Category:** SIEM\ **Tags:** detection-rules\ **Created:** [September 15, 2022, 4:02pm UTC](https://discuss.elastic.co/t/alert-when-an-event-is-not-followed-by-another/314527 "2022-09-15T16:02:23Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![bricevalenza](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bricevalenza/32/110949_2.png) [@bricevalenza](https://discuss.elastic.co/u/bricevalenza)\ **Post date:** [September 15, 2022, 4:02pm UTC](https://discuss.elastic.co/t/alert-when-an-event-is-not-followed-by-another/314527/1 "2022-09-15T16:02:23Z")
Hello, I am looking for a solution to create an alert when the following happens: An event with the field winlog.event\_id: "4202" occurs. 5 minutes later, no event with the field winlog.event\_id: "4204" was detected. ==\> Alert Do you think this is possible? Thank you. ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [September 15, 2022, 4:56pm UTC](https://discuss.elastic.co/t/alert-when-an-event-is-not-followed-by-another/314527/2 "2022-09-15T16:56:13Z")
I think this is possible if you use EQL. Check the documentation for [EQL searchs](https://www.elastic.co/guide/en/elasticsearch/reference/current/eql.html). ---
**Author:** ![bricevalenza](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bricevalenza/32/110949_2.png) [@bricevalenza](https://discuss.elastic.co/u/bricevalenza)\ **Post date:** [September 15, 2022, 7:40pm UTC](https://discuss.elastic.co/t/alert-when-an-event-is-not-followed-by-another/314527/3 "2022-09-15T19:40:42Z")
I have tried several times with the EQL language, but I can't get what I want ☹ ---
**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Post date:** [September 16, 2022, 8:14pm UTC](https://discuss.elastic.co/t/alert-when-an-event-is-not-followed-by-another/314527/4 "2022-09-16T20:14:45Z")
@bricevalenza I had a similar question some time ago which was never answered, see [Custom EQL Query where one event happened and another didnt](https://discuss.elastic.co/t/custom-eql-query-where-one-event-happened-and-another-didnt/296524) ---
**Author:** ![bricevalenza](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bricevalenza/32/110949_2.png) [@bricevalenza](https://discuss.elastic.co/u/bricevalenza)\ **Post date:** [September 20, 2022, 8:42am UTC](https://discuss.elastic.co/t/alert-when-an-event-is-not-followed-by-another/314527/5 "2022-09-20T08:42:15Z")
No one has any ideas? Thanks 🙂 ---
**Author:** ![jamesspi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jamesspi/32/24479_2.png) [@jamesspi](https://discuss.elastic.co/u/jamesspi)\ **Post date:** [September 23, 2022, 3:05pm UTC](https://discuss.elastic.co/t/alert-when-an-event-is-not-followed-by-another/314527/6 "2022-09-23T15:05:23Z")
Hi, unfortunately there is no easy way to do this today. We're working on being able to provide this functionality though, hopefully in the short term. James ---
**Author:** ![bricevalenza](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bricevalenza/32/110949_2.png) [@bricevalenza](https://discuss.elastic.co/u/bricevalenza)\ **Post date:** [September 26, 2022, 8:00am UTC](https://discuss.elastic.co/t/alert-when-an-event-is-not-followed-by-another/314527/7 "2022-09-26T08:00:05Z")
Hi, Thank you for your answer. I got around the problem by using an external monitoring tool (nagios plug-in). Via a request on the API, I get the last events with my two events as filter (the OK and the NOK). If the last event is the 4202 I put the check in "critical", if it is the 4204 I put it in "OK". on the supervision tool I can refine the check delays, and the triggering of the critical state. Thanks. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 24, 2022, 8:00am UTC](https://discuss.elastic.co/t/alert-when-an-event-is-not-followed-by-another/314527/8 "2022-10-24T08:00:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.