I was trying to replicate watcher functionality using SIEM detection rule. In watcher i can write elastic query, but can i perform that using detection rule ? Please help.

Can i write elastic query using KQL or Lucene

system (system) Closed May 19, 2020, 4:19am 4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Adding a condition in detection engine SIEM elastic-stack-alerting	2	989	May 8, 2020
Eql query usage in watcher/siem detection rules SIEM elastic-stack-alerting	1	481	December 17, 2020
Use ElasticEearch Query as Filter DSL Query in Discover Section of Kibana Kibana	3	877	September 24, 2019
Plans for KQL support in Kibana Stack Alert "Elasticsearch query"? Kibana	3	604	December 27, 2021
Elastic Lucene vs KQL vs DSL vs EQL Elasticsearch elastic-stack-security	2	5430	May 16, 2022