Hi In the detections, rules created a custom rule for my own index. A simple match query is not working, but the same rule is working with an aggregate query.! detections|690x283 The rule with custom query externalId: "4625" is not working. But the same rule with threshold query is working. With …

Detections with custom query

Frank_Hassanabad (Frank Hassanabad) October 21, 2020, 5:04pm 2

There's an in-depth explanation of parts fo the threshold rules with regards to fields that are aggregatable vs non-aggretable here that should help you out for trouble shooting issues:

Topic		Replies	Views
Detection threshold rule problem SIEM	6	932	April 22, 2021
Threshold rules not triggering on selfmade index SIEM elastic-stack-alerting	16	1981	November 6, 2020
Custom Rules not working SIEM elastic-stack-alerting	8	1469	January 13, 2021
Detection Custom Rule not working SIEM elastic-stack-alerting , detection-rules	8	1376	May 27, 2021
Problem with Detections - Custom query rule SIEM	10	683	September 8, 2022

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Detections with custom query

Related topics