# Elasticsearch security rule and alert testing

**URL:** <https://discuss.elastic.co/t/elasticsearch-security-rule-and-alert-testing/373610>\
**Category:** Elastic Security\
**Created:** [January 24, 2025, 2:34am UTC](https://discuss.elastic.co/t/elasticsearch-security-rule-and-alert-testing/373610 "2025-01-24T02:34:00Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![MarcTan](https://avatars.discourse-cdn.com/v4/letter/m/ea666f/32.png) [@MarcTan](https://discuss.elastic.co/u/MarcTan)\
**Post date:** [January 24, 2025, 2:34am UTC](https://discuss.elastic.co/t/elasticsearch-security-rule-and-alert-testing/373610/1 "2025-01-24T02:34:00Z")

</div>

Hi all,

I am testing out Elasticsearch security rule: User added to Privileged Group in Active Directory:

[User Added to Privileged Group in Active Directory | Elastic Security Solution [7.17] | Elastic](https://www.elastic.co/guide/en/security/7.17/prebuilt-rule-0-14-2-user-added-to-privileged-group-in-active-directory.html)

I have an active directory running and winlogbeat setup to receive windows events. As per the Rule indices i have setup the index pattern "winlogbeat-\*" and when i added an AD user to "Domain Admins" group, i can see the event id 4728 for user added to privileged group being recorded in the Discover tab for index pattern "winlogbeat-\*" but the security rule doesn't seem to pick it up or show any response although it is enabled.

Will like some advice if i am missing out on any settings. Thanks!

---

<div class="post-metadata">

**Author:** ![Jatin\_Kathuria](https://avatars.discourse-cdn.com/v4/letter/j/d6d6ee/32.png) [@Jatin\_Kathuria](https://discuss.elastic.co/u/Jatin_Kathuria)\
**Post date:** [January 24, 2025, 12:02pm UTC](https://discuss.elastic.co/t/elasticsearch-security-rule-and-alert-testing/373610/2 "2025-01-24T12:02:45Z")

</div>

Hey @MarcTan,

Could you please share JSON of the original event document that you see in Discover.

Also, just to confirm, you are on version `7.17`, correct?

---

<div class="post-metadata">

**Author:** ![MarcTan](https://avatars.discourse-cdn.com/v4/letter/m/ea666f/32.png) [@MarcTan](https://discuss.elastic.co/u/MarcTan)\
**Post date:** [January 27, 2025, 5:20am UTC](https://discuss.elastic.co/t/elasticsearch-security-rule-and-alert-testing/373610/3 "2025-01-27T05:20:18Z")

</div>

Hi,

Yes my version is 7.17, i am unable to share the JSON document as it resides in the protected network of my organisation, but i have verified the following:

event.category: ["iam"]  
event.action: "added-member-to-group"  
group.name: "Domain Admins"  
\_index: "winlogbeat-7.17.17-2025.01.10-000001"

Winlogbeat version is 7.17.17, Kibana version is 7.17.23

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 24, 2025, 5:20am UTC](https://discuss.elastic.co/t/elasticsearch-security-rule-and-alert-testing/373610/4 "2025-02-24T05:20:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.