Detection rule kquery will not trigger but the query match

[aditi_salunke]

Hi @Mike_Paquette @leon3

I am facing kinda same issue. Can you please help

Here is the link of issue:

Detection rules which are based on indices where host field is fetched as string are not generating the alerts

Bulk Indexing of signals failed: object mapping for [host] tried to parse field [host] as object, but found a concrete value name: "<rule name>:<random id>" rule id: "<rule_id>" signals index: ".siem-signals-default" So above reason we are getting in 'failure history' of some rules Though the query is triggering alerts in preview while creating rule after activation it's not triggering any alerts Things which i found might be concern: In X index, mapping is dynamic, host field is present i…