# Elastic SIEM Detection Rules

**URL:** <https://discuss.elastic.co/t/elastic-siem-detection-rules/370390>\
**Category:** SIEM\
**Created:** [November 12, 2024, 12:01pm UTC](https://discuss.elastic.co/t/elastic-siem-detection-rules/370390 "2024-11-12T12:01:18Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![aravindraja](https://avatars.discourse-cdn.com/v4/letter/a/edb3f5/32.png) [@aravindraja](https://discuss.elastic.co/u/aravindraja)\
**Post date:** [November 12, 2024, 12:01pm UTC](https://discuss.elastic.co/t/elastic-siem-detection-rules/370390/1 "2024-11-12T12:01:19Z")

</div>

Hi Team,

I have 2 windows endpoints with 2 different agent policies where in one endpoint I have integrated the **system** integration and in another endpoint I have integrated **Windows** , So in this case of SIEM detection rule do I actually need both of the integration in my both agent policies to make the detection rule to work?

Some of the rules shows 6 available integrations so do I need all the 6 to trigger the alert if it occurs?

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/9/b90bfea3c71f47b9fe6560a65fdef1f6fcb8a2f9.png)

Thanks in advance

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [November 12, 2024, 1:07pm UTC](https://discuss.elastic.co/t/elastic-siem-detection-rules/370390/2 "2024-11-12T13:07:51Z")

</div>

Hello and welcome,

As the message says:

> _(...) enable **one** or **more** of the below integrations (...)_

So you need at least one of the integrations, this happens because the events required to trigger the rule can be provided in different ways by different integrations, if you check how the rule works you will see that there are a couple of conditionals to make it trigger with events from both integrations.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 10, 2024, 1:08pm UTC](https://discuss.elastic.co/t/elastic-siem-detection-rules/370390/3 "2024-12-10T13:08:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.