# Alert when an event is not followed by another

**URL:** <https://discuss.elastic.co/t/alert-when-an-event-is-not-followed-by-another/314527>\
**Category:** SIEM\
**Tags:** detection-rules\
**Created:** [September 15, 2022, 4:02pm UTC](https://discuss.elastic.co/t/alert-when-an-event-is-not-followed-by-another/314527 "2022-09-15T16:02:23Z")\
**Posts on this page:** 1\
**Showing post:** 7

<div class="post-metadata">

**Author:** ![bricevalenza](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bricevalenza/32/110949_2.png) [@bricevalenza](https://discuss.elastic.co/u/bricevalenza)\
**Post date:** [September 26, 2022, 8:00am UTC](https://discuss.elastic.co/t/alert-when-an-event-is-not-followed-by-another/314527/7 "2022-09-26T08:00:05Z")

</div>

Hi,

Thank you for your answer. I got around the problem by using an external monitoring tool (nagios plug-in).

Via a request on the API, I get the last events with my two events as filter (the OK and the NOK). If the last event is the 4202 I put the check in "critical", if it is the 4204 I put it in "OK".  
on the supervision tool I can refine the check delays, and the triggering of the critical state.

Thanks.

---

_[View the full topic](https://discuss.elastic.co/t/alert-when-an-event-is-not-followed-by-another/314527)._