The sample data and mappings are the same posted in Detections with custom query
Regarding to kibana logs, the error that appear is:
{"type":"log","@timestamp":"2020-10-21T14:16:06Z","tags":["error","plugins","securitySolution","plugins","securitySolution"],"pid":6587,"message":"[-] search_after and bulk threw an error TypeError: Cannot read property 'some' of undefined name: \"Rogue AP Detection\" id: \"376e5caf-7fa0-4657-87b5-33ee249f9b3b\" rule id: \"b57a7041-d90f-4023-adf4-09e19182dcea\" signals index: \".siem-signals-siem\""}
But I still believe that is something related to the space name (siem). In the new space (temp) I did not have any errors.
Thank you
Regards
Anna