### Author:  [@Jonathan\_Buttner](https://discuss.elastic.co/u/Jonathan_Buttner)
#### Post date: [November 24, 2021, 7:31pm UTC](https://discuss.elastic.co/t/elastic-siem-security-rules-doesnt-work/290094/2 "2021-11-24T19:31:21Z")
Hey @Dmitriy_Esin thanks for the question!
If you click on the `Rule Monitoring` tab within `Rules`, does it show any error messages relating to the prebuilt rules?
Could you also provide some Kibana logs? The Detection Rules should log some warnings and errors if they're running into problems.
---
### Author:  [@Dmitriy\_Esin](https://discuss.elastic.co/u/Dmitriy_Esin)
#### Post date: [November 25, 2021, 9:47am UTC](https://discuss.elastic.co/t/elastic-siem-security-rules-doesnt-work/290094/3 "2021-11-25T09:47:15Z")
Hi @Jonathan_Buttner thanks for you reply!
Here is the example screenshot of the the prebuilt rule:
I have specific warnings in each prebuilt rule.
Unfortunately I can't find any logs from Kibana in web UI (elastic stack is in kubernetes), but I've found container logs (may be it's wrong logs)
>
Thank you for your help!
---
### Author:  [@Dmitriy\_Esin](https://discuss.elastic.co/u/Dmitriy_Esin)
#### Post date: [November 29, 2021, 2:07pm UTC](https://discuss.elastic.co/t/elastic-siem-security-rules-doesnt-work/290094/4 "2021-11-29T14:07:16Z")
Any update on this? Thank you!
---
### Author:  [@Dmitriy\_Esin](https://discuss.elastic.co/u/Dmitriy_Esin)
#### Post date: [November 29, 2021, 2:09pm UTC](https://discuss.elastic.co/t/elastic-siem-security-rules-doesnt-work/290094/5 "2021-11-29T14:09:59Z")
Here is nothing to configure
---
### Author:  [@Jonathan\_Buttner](https://discuss.elastic.co/u/Jonathan_Buttner)
#### Post date: [November 29, 2021, 6:24pm UTC](https://discuss.elastic.co/t/elastic-siem-security-rules-doesnt-work/290094/6 "2021-11-29T18:24:58Z")
Hey @Dmitriy_Esin looks like the issues is that the rule isn't seeing data within the index patterns `auditbeat-*` or `logs-endpoint.events.*`. Could you check the Stack Management -\> Index Management page, enable hidden indices, and then search for `auditbeat` or `events` and see if anything comes up that would match those patterns?
Here's an example
If the Docs count is zero or nothing is found it likely means that Elasticsearch hasn't received any events from auditbeat or the elastic endpoint.
---
### Author:  [@Dmitriy\_Esin](https://discuss.elastic.co/u/Dmitriy_Esin)
#### Post date: [November 29, 2021, 6:32pm UTC](https://discuss.elastic.co/t/elastic-siem-security-rules-doesnt-work/290094/7 "2021-11-29T18:32:20Z")
Hi @Jonathan_Buttner !
Yes, unfortunately, I've tried it, but there are no indices that we need
---
### Author:  [@Dmitriy\_Esin](https://discuss.elastic.co/u/Dmitriy_Esin)
#### Post date: [November 29, 2021, 6:34pm UTC](https://discuss.elastic.co/t/elastic-siem-security-rules-doesnt-work/290094/8 "2021-11-29T18:34:38Z")
I know that agents create indices themselves when we use any integration, but there is no Prebuilt Security Rules integration in my elastic-agent.yml and I can't configure it ☹
---
### Author:  [@Dmitriy\_Esin](https://discuss.elastic.co/u/Dmitriy_Esin)
#### Post date: [November 29, 2021, 6:37pm UTC](https://discuss.elastic.co/t/elastic-siem-security-rules-doesnt-work/290094/9 "2021-11-29T18:37:06Z")
thank you for your answer! I'll try to install auditbeat.
---
### Author:  [@Dmitriy\_Esin](https://discuss.elastic.co/u/Dmitriy_Esin)
#### Post date: [November 29, 2021, 6:49pm UTC](https://discuss.elastic.co/t/elastic-siem-security-rules-doesnt-work/290094/10 "2021-11-29T18:49:02Z")
Thank you so much!!!
You saved me!
It works well now!
---
### Author:  [@Dmitriy\_Esin](https://discuss.elastic.co/u/Dmitriy_Esin)
#### Post date: [November 29, 2021, 7:31pm UTC](https://discuss.elastic.co/t/elastic-siem-security-rules-doesnt-work/290094/11 "2021-11-29T19:31:55Z")
@Jonathan_Buttner one more question from me:
All rules are well, and I'm very grateful to you for your assistance, but one rule has a status "warning"
Can I kindly ask you to help to understand how to resolve it?
---
### Author:  [@Jonathan\_Buttner](https://discuss.elastic.co/u/Jonathan_Buttner)
#### Post date: [November 29, 2021, 7:58pm UTC](https://discuss.elastic.co/t/elastic-siem-security-rules-doesnt-work/290094/12 "2021-11-29T19:58:38Z")
I'm glad you got it working! The warnings about the `event.ingested` are indicating that auditbeat and elastic agent aren't populating the `event.ingested` field. While it's ideal to have this field populated it's not required. The detection rules will fallback to using the `@timestamp` field instead. You could add a new pipeline that sets this field like this: [https://github.com/elastic/beats/pull/20386/files#diff-c6f5ae0e8e34c2011f1b042924c2e20d59df35ae8d70786ec56970fa77c8e973R3-R5](https://github.com/elastic/beats/pull/20386/files#diff-c6f5ae0e8e34c2011f1b042924c2e20d59df35ae8d70786ec56970fa77c8e973R3-R5)
and configure it to be used in auditbeat: [Define processors | Auditbeat Reference [8.11] | Elastic](https://www.elastic.co/guide/en/beats/auditbeat/current/defining-processors.html)
I believe filebeat populates this field by default but the other beats don't.
For more details on what `event.ingested` is used for: [Create a detection rule | Elastic Security Solution [8.11] | Elastic](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#rule-ui-advanced-params)
Specifically item `j`:
> **Timestamp override** (optional): Select a source event timestamp field. When selected, the rule’s query uses the selected field, instead of the default `@timestamp` field, to search for alerts. This can help reduce missing alerts due to network or server outages. Specifically, if your ingest pipeline adds a timestamp when events are sent to Elasticsearch, this avoids missing alerts due to ingestion delays.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 27, 2021, 7:59pm UTC](https://discuss.elastic.co/t/elastic-siem-security-rules-doesnt-work/290094/13 "2021-12-27T19:59:26Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.