# Custom SIEM rules: illegal\_argument\_exception permission issue
**URL:** https://discuss.elastic.co/t/custom-siem-rules-illegal-argument-exception-permission-issue/253787
**Category:** SIEM
**Created:** [October 30, 2020, 9:06am UTC](https://discuss.elastic.co/t/custom-siem-rules-illegal-argument-exception-permission-issue/253787 "2020-10-30T09:06:33Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@kelk](https://discuss.elastic.co/u/kelk)
#### Post date: [October 30, 2020, 9:06am UTC](https://discuss.elastic.co/t/custom-siem-rules-illegal-argument-exception-permission-issue/253787/1 "2020-10-30T09:06:33Z")
I've created a custom rule, which seems working if I run via the console. But when I put it as a SIEM rule, below error occurs
Any idea which permission/privilege I need to do to fix the issue?
```auto
An error occurred during rule execution: message: "
[illegal_argument_exception] unknown cluster privilege [grant_api_key].
a privilege must be either one of the predefined cluster privilege names [monitor_ml,manage_enrich,read_slm,monitor_watcher,manage_index_templates,manage_ccr,monitor_transform,delegate_pki,none,monitor_snapshot,manage_data_frame_transforms,
read_ilm,monitor_data_frame_transforms,manage_api_key,manage_security,
manage_saml,manage_own_api_key,all,manage_ilm,manage_oidc,manage_ingest_pipelines,read_ccr,monitor,manage_rollup,manage_slm,manage_watcher,manage,manage_transform,
manage_token,manage_ml,manage_pipeline,monitor_rollup,transport_client,create_snapshot] or a pattern over one of the available cluster actions"
name: "MY_CUSTOM_RULE_ID" id: "4a5b8028-d035-43f4-814c-3cf7fb6d0598" rule id: "MY_CUSTOM_RULE_ID" signals index: ".siem-signals-default"
```
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [November 2, 2020, 3:11am UTC](https://discuss.elastic.co/t/custom-siem-rules-illegal-argument-exception-permission-issue/253787/2 "2020-11-02T03:11:09Z")
What version of Elasticsearch are you using?
---
### Author:  [@kelk](https://discuss.elastic.co/u/kelk)
#### Post date: [November 3, 2020, 9:35am UTC](https://discuss.elastic.co/t/custom-siem-rules-illegal-argument-exception-permission-issue/253787/3 "2020-11-03T09:35:12Z")
7.8.1
---
### Author:  [@RylandHerrick](https://discuss.elastic.co/u/RylandHerrick)
#### Post date: [November 5, 2020, 7:00pm UTC](https://discuss.elastic.co/t/custom-siem-rules-illegal-argument-exception-permission-issue/253787/4 "2020-11-05T19:00:34Z")
@kelk thanks for the info, I've got a few follow up questions to try and narrow this down:
1. Do you have security enabled on your stack? How are you authenticating/creating users, etc. ?
2.
> I've created a custom rule, which seems working if I run via the console
Could you explain this in a bit more detail? Are you performing an analogous query in kibana's dev console, or via `curl`? A copy of this working query would be very helpful (and who you're authenticated as when performing it).
Thanks in advance!
---
### Author:  [@kelk](https://discuss.elastic.co/u/kelk)
#### Post date: [November 6, 2020, 4:39pm UTC](https://discuss.elastic.co/t/custom-siem-rules-illegal-argument-exception-permission-issue/253787/5 "2020-11-06T16:39:02Z")
Yes security is enabled on stack. authenticating user via Kibana (role is superuser)
code below. This is a simple test for certain event code. the only change is to send to `my_own_index`
```
{
"actions": [],
"description": "TEST TEST TEST",
"enabled": true,
"false_positives": [],
"from": "now-60m",
"index": ["*win*"],
"interval": "30m",
"language": "kuery",
"max_signals": 100,
"name": "TEST FOR MANIPULATE FIREWALL ",
"output_index": "my_own_index",
"query": "\n event.code:(4950 or 853)\n ",
"filters": [],
"references": [],
"risk_score": 48,
"rule_id": "SIMPLE_TEST_RULE_ID",
"severity": "low",
"tags": ["Elastic", "Host", "Windows", "Defense Evasion"],
"threat": [
{
"framework": "MITRE ATT&CK",
"tactic": {
"id": "TA0005",
"name": "Defense Evasion",
"reference": "https://attack.mitre.org/tactics/TA0005"
},
"technique": [
{
"id": "T1562",
"name": "Disabling Security Tools",
"reference": "https://attack.mitre.org/techniques/T1562"
}
]
}
],
"throttle": "no_actions",
"to": "now-30m",
"type": "query"
```
}
---
### Author:  [@RylandHerrick](https://discuss.elastic.co/u/RylandHerrick)
#### Post date: [November 6, 2020, 11:34pm UTC](https://discuss.elastic.co/t/custom-siem-rules-illegal-argument-exception-permission-issue/253787/6 "2020-11-06T23:34:27Z")
@kelk I don't see anything inherently wrong with that rule, but I do want to note that the leading wildcard on your index pattern could cause the rule to query across clusters; that may be a clue to your problem. However, it's unclear in your previous message whether this rule is working (or not), and what differences it has from the broken (or not) rule. It would be ideal if you could provide both:
1. A minimal example of a rule that isn't working
2. A minimal example of a rule that _is_ working, as similar to the working rule as possible. If you don't have such an example rule, please explain (with examples) the reasoning behind your original statement "a custom rule, which seems working if I run via the console"
Thanks in advance, I look forward to figuring this out with you!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 4, 2020, 11:34pm UTC](https://discuss.elastic.co/t/custom-siem-rules-illegal-argument-exception-permission-issue/253787/7 "2020-12-04T23:34:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.