I created a custom detection rule which is just a query for failed logins (event.code : "4625") I have pointed it to the index pattern and I can see the output on preview results as well. After enabling the rule there is no alert is creating even though there are failed logins. There is No execut…

Custom Query detection Rule is not runnig on my elk

system (system) Closed April 6, 2023, 10:21pm 4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Rules not triggering alerts Elastic Security detection-rules	6	3581	October 19, 2021
Rule hits visible in preview, but no alerts triggered Elastic Security	5	1470	November 27, 2021
Problem with Detections - Custom query rule SIEM	10	788	September 8, 2022
Run detection rule manually Elastic Security	2	994	November 4, 2022
Detection rule kquery will not trigger but the query match SIEM	4	1401	June 28, 2021