# Cannot view alerted log in security alert **URL:** \ **Category:** SIEM\ **Created:** [October 10, 2024, 6:25am UTC](https://discuss.elastic.co/t/cannot-view-alerted-log-in-security-alert/368594 "2024-10-10T06:25:50Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Tee55](https://avatars.discourse-cdn.com/v4/letter/t/e95f7d/32.png) [@Tee55](https://discuss.elastic.co/u/Tee55)\ **Post date:** [October 10, 2024, 6:25am UTC](https://discuss.elastic.co/t/cannot-view-alerted-log-in-security-alert/368594/1 "2024-10-10T06:25:50Z")
I tried to create a custom detection rule for MITRE ATT&CK T1078 using the json logs as shown in image below: ![Screenshot 2024-10-10 131523](https://us1.discourse-cdn.com/elastic/original/3X/9/2/92a6d1e2caf8a9b20a7321616f46f243b245442a.png) I upload my log file using " Upload data from a file" integration. Then, I tried to create simple rule using custom query matching: action is created. But still I cannot see any alert in alert dashboard Did I miss something? Thank you for your help in advanced. ---
**Author:** ![Tee55](https://avatars.discourse-cdn.com/v4/letter/t/e95f7d/32.png) [@Tee55](https://discuss.elastic.co/u/Tee55)\ **Post date:** [October 10, 2024, 6:26am UTC](https://discuss.elastic.co/t/cannot-view-alerted-log-in-security-alert/368594/2 "2024-10-10T06:26:59Z")
This image show my simple rule using custom query matching: action is created ![Screenshot 2024-10-10 131730](https://us1.discourse-cdn.com/elastic/original/3X/a/8/a85e0825df8dfc95a38d4377a3476ade075230ce.png) ---
**Author:** ![Tee55](https://avatars.discourse-cdn.com/v4/letter/t/e95f7d/32.png) [@Tee55](https://discuss.elastic.co/u/Tee55)\ **Post date:** [October 10, 2024, 6:27am UTC](https://discuss.elastic.co/t/cannot-view-alerted-log-in-security-alert/368594/3 "2024-10-10T06:27:50Z")
This image show my alert dashboard that I cannot see any alert. ![Screenshot 2024-10-10 131903](https://us1.discourse-cdn.com/elastic/original/3X/f/4/f4146d73e0352171d69980e582363855f88cca4a.png) ---
**Author:** ![RylandHerrick](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rylandherrick/32/67401_2.png) [@RylandHerrick](https://discuss.elastic.co/u/RylandHerrick)\ **Post date:** [October 11, 2024, 8:10pm UTC](https://discuss.elastic.co/t/cannot-view-alerted-log-in-security-alert/368594/4 "2024-10-11T20:10:36Z")
Hi @Tee55 ! There are a number of possible issues here, but we can try to work through them to identify the root cause: 1. Is your rule looking at the correct time window that contains the `action: created` document in question? It looks like the document has a `@timestamp` from June, but rules by default usually only look at the last few minutes' worth of data. 2. Are your mappings correct? I noticed that you had some errors in the Rule Preview pane, which may be indicating a problem with your data. 3. If neither of the above is fruitful, sharing: ---
**Author:** ![RylandHerrick](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rylandherrick/32/67401_2.png) [@RylandHerrick](https://discuss.elastic.co/u/RylandHerrick)\ **Post date:** [October 22, 2024, 10:23pm UTC](https://discuss.elastic.co/t/cannot-view-alerted-log-in-security-alert/368594/5 "2024-10-22T22:23:00Z")
Hey @Tee55 ! Were you able to find a solution? We'd love to hear about it! If not, please let us know how we can help further. Thanks! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 19, 2024, 10:23pm UTC](https://discuss.elastic.co/t/cannot-view-alerted-log-in-security-alert/368594/6 "2024-11-19T22:23:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.