Detection Rule Error

[Frank_Hassanabad]

You could have more than one error going on. I did post that I found a mapping conflict between your custom one and the ECS signals mapping:

Detections with custom query

Hi @Anabella_Cristaldi, Appreciate the sample thank you! I do not see why is working for threshold but not for custom query (Does they have a different mechanism for quering)? Yes, they do have different mechanisms. The threshold one is an aggregation and it does not fill in all the values when it creates a signal. So, some good news is that in the soon to be released 7.10.0 where we improved error handling you will begin to see errors on that rule where before you were not. I just …

I would clean up the mappings around host and double check to ensure there aren't other conflicts and then from there we can see if you still have an issue on this one with the space name.