Hi, We are running multiple watchers and as the SIEM detection does not provide the level of customizations, I have been unable to create use cases which takes aggregation for example under consideration. So I want to create a rule in SIEM that it has to check the alerts index every 5 mins and gene…

Hi, Did you add the index pattern into siem default indices? (via stack management->kibana-> advanced setting) If you did, it should be available in the index patterns section when you want to create a new rule. also, try a different query like somefield : * and see if it works.

I have added alerts* under default indices and still not working - [image] Here is the use case - [image] When I run the same query in Discover Kibana, I get the events, but the Detection rule is not letting me do it. [image] I would need help with the other suggestions from Frank - a) How…

instead of _index : "alerts*" try something like agent.name : * and see if it works. [image] Suro: How do I check the mapping of the index. you can also use mapping API for that.

Tried that ....did not work - [image]

my bad the field name Agent doesnot exists in Alerts index. So I am trying one Use case specifically and trying to see if that is generated!!!!

That did not work- here is the discover query- [image] With the same parameters, here is the Detection rule - [image] Still no detections.

What's the mapping? Run something like this below in your dev tools and see what it is. The signals index mapping is that of ECS, so if there is a conflict or issue where the source index which is your alerts in this case is too far away from ECS then it more than likely is not going to work out for…

Here is the output - { "alerts" : { "mappings" : { "properties" : { "@timestamp" : { "type" : "date" }, "agent" : { "properties" : { "hostname" : { "type" : "keyword" }, "name" : { …

Don't see any mapping conflicts with it at the moment. If you have access to your Kibana logs do you see any errors when the signals are being run?

Calling Alerts from Watchers to detection Signals

Elastic Security SIEM

Frank_Hassanabad (Frank Hassanabad) September 25, 2020, 11:35pm 2

We do currently have threshold rules that might help you out?

But if not your current issue could be that the alert index is not compatible with the ECS (Elastic Common Schema) and then cannot copy over the signal.

Do you have the mapping of the alert index you are trying to create a signal from? I can take a look for you. We have improved the error messaging in our next upcoming release to report more errors transparently to the UI from this release fwiw:

Topic		Replies	Views
How to exploit rules Elastic Security	11	1162	May 9, 2023
Detection rules SIEM detection-rules	4	750	January 11, 2021
SIEM Signals not triggering SIEM	11	1061	December 7, 2020
Detection Custom Rule not working SIEM	18	2614	March 28, 2020
Detections with custom query SIEM detection-rules	15	2433	November 27, 2020

Calling Alerts from Watchers to detection Signals

Related topics