# Detection Rule with query issues **URL:** \ **Category:** SIEM\ **Tags:** detection-rules\ **Created:** [July 3, 2021, 11:05am UTC](https://discuss.elastic.co/t/detection-rule-with-query-issues/277706 "2021-07-03T11:05:19Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![ethical20](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ethical20/32/68123_2.png) [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Post date:** [July 3, 2021, 11:05am UTC](https://discuss.elastic.co/t/detection-rule-with-query-issues/277706/1 "2021-07-03T11:05:19Z")
Hi All, I've made a custom detection rule to detect windows defender events related to malware or stop based on the below documentation: > **[Microsoft Defender AV event IDs and error codes](https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#to-view-a-microsoft-defender-antivirus-event)** > > Look up the causes and solutions for Microsoft Defender Antivirus event IDs and errors The query is as bellow: ```auto winlog.event_id: "1002" or "1003" or "1005" or "1006" or "1007" or "1008" or "1013" or "1116" or "1117" or "1118" ``` ![Rule](https://us1.discourse-cdn.com/elastic/original/3X/b/d/bd966e9de4176a73a708a9b8fce3802379d77886.png) But I'm getting false positives where the rule is triggered on events other than the ones listed in the rule. ![InkedCapture1_LI](https://us1.discourse-cdn.com/elastic/original/3X/7/e/7e6e51dfb05fadc908a04f09eccc04ddfa22aaf4.jpeg) Any help on this is really appreciated. Regards, ---
**Author:** ![termcap](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/termcap/32/91415_2.png) [@termcap](https://discuss.elastic.co/u/termcap)\ **Post date:** [July 5, 2021, 10:55am UTC](https://discuss.elastic.co/t/detection-rule-with-query-issues/277706/2 "2021-07-05T10:55:32Z")
Hi, Can you rephrase the query like this: winlog.event\_id:( 1002 or 1003 or 1005 or 1006 or 1007 or 1008 or 1013 or 1116 or 1117 or 1118) Thanks, Termcap ---
**Author:** ![ethical20](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ethical20/32/68123_2.png) [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Post date:** [July 5, 2021, 11:13am UTC](https://discuss.elastic.co/t/detection-rule-with-query-issues/277706/3 "2021-07-05T11:13:17Z")
perfect this worked, but what is the difference between the query I've done and the one you provided? Regards, ---
**Author:** ![termcap](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/termcap/32/91415_2.png) [@termcap](https://discuss.elastic.co/u/termcap)\ **Post date:** [July 5, 2021, 5:41pm UTC](https://discuss.elastic.co/t/detection-rule-with-query-issues/277706/4 "2021-07-05T17:41:52Z")
I'm not completely sure but there are two things I can see here: When you don't group the values inside a bracket the query becomes something like winlog.event\_id: "10002" OR "1003" OR "1234" and the field name winlog.event\_id does not apply to "1003" and "1234" secondly when you quote the value its treated as a string and not number. I use the format I suggested because this is the kind of format I see being used in the default detection rules. Thanks, Termcap ---
**Author:** ![ethical20](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ethical20/32/68123_2.png) [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Post date:** [July 6, 2021, 7:24am UTC](https://discuss.elastic.co/t/detection-rule-with-query-issues/277706/5 "2021-07-06T07:24:26Z")
Perfect, many thanks. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 3, 2021, 7:25am UTC](https://discuss.elastic.co/t/detection-rule-with-query-issues/277706/6 "2021-08-03T07:25:24Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.