# Alert when an event is not followed by another

**URL:** <https://discuss.elastic.co/t/alert-when-an-event-is-not-followed-by-another/314527>\
**Category:** SIEM\
**Tags:** detection-rules\
**Created:** [September 15, 2022, 4:02pm UTC](https://discuss.elastic.co/t/alert-when-an-event-is-not-followed-by-another/314527 "2022-09-15T16:02:23Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Post date:** [September 16, 2022, 8:14pm UTC](https://discuss.elastic.co/t/alert-when-an-event-is-not-followed-by-another/314527/4 "2022-09-16T20:14:45Z")

</div>

@bricevalenza I had a similar question some time ago which was never answered, see [Custom EQL Query where one event happened and another didnt](https://discuss.elastic.co/t/custom-eql-query-where-one-event-happened-and-another-didnt/296524)

---

_[View the full topic](https://discuss.elastic.co/t/alert-when-an-event-is-not-followed-by-another/314527)._