# Error in detection rule: Remote Computer Account DnsHostName Update

**URL:** <https://discuss.elastic.co/t/error-in-detection-rule-remote-computer-account-dnshostname-update/377772>\
**Category:** SIEM\
**Created:** [May 3, 2025, 8:45am UTC](https://discuss.elastic.co/t/error-in-detection-rule-remote-computer-account-dnshostname-update/377772 "2025-05-03T08:45:03Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![GKre](https://avatars.discourse-cdn.com/v4/letter/g/ecae2f/32.png) [@GKre](https://discuss.elastic.co/u/GKre)\
**Post date:** [May 3, 2025, 8:45am UTC](https://discuss.elastic.co/t/error-in-detection-rule-remote-computer-account-dnshostname-update/377772/1 "2025-05-03T08:45:03Z")

</div>

I have an issue with a detection rule. Seems like there's a type mismatch in tables. Is this something i could fix myself or should this be handled by dev?

```auto
{
  "@timestamp": [
    "2025-05-03T08:36:23.495Z"
  ],
  "ecs.version": [
    "1.8.0"
  ],
  "event.action": [
    "status-change"
  ],
  "event.kind": [
    "event"
  ],
  "event.provider": [
    "securitySolution.ruleExecution"
  ],
  "event.sequence": [
    2
  ],
  "event.severity": [
    40
  ],
  "kibana.alert.rule.execution.status": [
    "failed"
  ],
  "kibana.alert.rule.execution.status_order": [
    30
  ],
  "kibana.alert.rule.execution.uuid": [
    "ca46331b-2f49-410a-82c7-cdaca71c11b3"
  ],
  "kibana.alert.rule.revision": [
    103
  ],
  "kibana.saved_objects": [
    {
      "rel": [
        "primary"
      ],
      "id": [
        "541b2b40-caed-11ed-9d31-81c7b0c1937c"
      ],
      "type": [
        "alert"
      ]
    }
  ],
  "kibana.server_uuid": [
    "7bd6d26c-186b-4bf5-8a93-8be24fecb77e"
  ],
  "kibana.space_ids": [
    "default"
  ],
  "kibana.version": [
    "8.18.0"
  ],
  "log.level": [
    "error"
  ],
  "message": [
    "verification_exception\n\tRoot causes:\n\t\tverification_exception: Found 1 problem\nline 6:42: Cannot use field [source.ip] due to ambiguities being mapped as [2] incompatible types: [keyword] in [.ds-logs-system.security-default-2025.03.16-000049], [ip] in [.ds-logs-system.auth-default-2025.02.14-000047, .ds-logs-system.auth-default-2025.03.16-000049, .ds-logs-system.auth-default-2025.04.15-000050, .ds-logs-system.security-default-2025.02.14-000048, .ds-logs-system.security-default-2025.04.15-000050]"
  ],
  "rule.category": [
    "siem.eqlRule"
  ],
  "rule.id": [
    "541b2b40-caed-11ed-9d31-81c7b0c1937c"
  ],
  "rule.name": [
    "Remote Computer Account DnsHostName Update"
  ],
  "rule.uuid": [
    "6bed021a-0afb-461c-acbe-ffdb9574d3f3"
  ],
  "_id": "XoVKlZYBVbwnv2qIGVPX",
  "_index": ".ds-.kibana-event-log-ds-2025.04.30-000134",
  "_score": null
}

```

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [May 3, 2025, 2:07pm UTC](https://discuss.elastic.co/t/error-in-detection-rule-remote-computer-account-dnshostname-update/377772/2 "2025-05-03T14:07:53Z")

</div>

This is a mapping conflict, the problema is that it is happening with an Elastic Agent integration.

Can you confirm which is the version of the System integration that you are using now?

This issue was introduces on this [PR](https://github.com/elastic/integrations/pull/12889/), for the integration System (`1.67.0`) and Windows (`2.5.0`)

It broke the ECS mappings for some indices, which breaks alerts, visualizations, dashboards etc, so it was reverted on this [PR](https://github.com/elastic/integrations/pull/13044), the fixed versions of the integrations are `1.67.3` for the System integration and `2.5.2` for the Windows integration.

It seems that you are already using the fixed integrations, but to fix this issue is more complicated.

The easiest way to fix this would be by either removing the backing indice with the wrong mapping, or reindexing it and then removing it.

Can you remove this or do you need to still keep the backing indice?

---

<div class="post-metadata">

**Author:** ![GKre](https://avatars.discourse-cdn.com/v4/letter/g/ecae2f/32.png) [@GKre](https://discuss.elastic.co/u/GKre)\
**Post date:** [May 3, 2025, 2:18pm UTC](https://discuss.elastic.co/t/error-in-detection-rule-remote-computer-account-dnshostname-update/377772/3 "2025-05-03T14:18:01Z")

</div>

Hello Leandro,

first of all - i am not an expert and this is a test / demo environment.  
So "loss of data" would not be a problem.

System Intergration is on 1.68.2 Windows Integration is not installed.

Could you give me a hint on how to fix this issue?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [May 3, 2025, 2:36pm UTC](https://discuss.elastic.co/t/error-in-detection-rule-remote-computer-account-dnshostname-update/377772/4 "2025-05-03T14:36:57Z")

</div>

Since data loss is not a problem, removing the conflicting index should fix the issue.

Just go into Kibana \> Dev Tools and run this request:

```auto
DELETE .ds-logs-system.security-default-2025.03.16-000049

```

This will delete the backing indice `.ds-logs-system.security-default-2025.03.16-000049` for the data stream `logs-system.security-default`, the data will be removed from the cluster and the conflict will stop as all other backing indices have the correct mapping.

---

<div class="post-metadata">

**Author:** ![GKre](https://avatars.discourse-cdn.com/v4/letter/g/ecae2f/32.png) [@GKre](https://discuss.elastic.co/u/GKre)\
**Post date:** [May 3, 2025, 2:43pm UTC](https://discuss.elastic.co/t/error-in-detection-rule-remote-computer-account-dnshostname-update/377772/5 "2025-05-03T14:43:05Z")

</div>

Thank you. Guess the

> [@leandrojmp](#):
>
> .ds-logs-system.security-default-

will than be recreated on need?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [May 3, 2025, 2:48pm UTC](https://discuss.elastic.co/t/error-in-detection-rule-remote-computer-account-dnshostname-update/377772/6 "2025-05-03T14:48:54Z")

</div>

> [@GKre](#):
>
> will than be recreated on need?

A new backing indice already exists.

Data Stream writes data into backing indices that are created according to an Index Lifecycle Policy, you seem to be using the default one, so a new backing indice will be create every 30 days given or taken or when it reaches 50 GB of size.

Currently the data stream `logs-system.security-defaul` in your cluster seems to have these backing indices:

```auto
.ds-logs-system.security-default-2025.02.14-000048
.ds-logs-system.security-default-2025.03.16-000049
.ds-logs-system.security-default-2025.04.15-000050

```

The most recent one is `.ds-logs-system.security-default-2025.04.15-000050`, so this is where the recent data is being written, on May 15th the data stream will rolover and a new backing indice will be created, you do not need to do anything.

---

<div class="post-metadata">

**Author:** ![GKre](https://avatars.discourse-cdn.com/v4/letter/g/ecae2f/32.png) [@GKre](https://discuss.elastic.co/u/GKre)\
**Post date:** [May 3, 2025, 3:44pm UTC](https://discuss.elastic.co/t/error-in-detection-rule-remote-computer-account-dnshostname-update/377772/7 "2025-05-03T15:44:23Z")

</div>

thank you Leandro,

```auto
DELETE .ds-logs-system.security-default-2025.03.16-000049
{
  "acknowledged": true
}

```

I will keep an eye on this now.

---

<div class="post-metadata">

**Author:** ![GKre](https://avatars.discourse-cdn.com/v4/letter/g/ecae2f/32.png) [@GKre](https://discuss.elastic.co/u/GKre)\
**Post date:** [May 3, 2025, 4:24pm UTC](https://discuss.elastic.co/t/error-in-detection-rule-remote-computer-account-dnshostname-update/377772/8 "2025-05-03T16:24:34Z")

</div>

Maybe a side effect but the "[Elastic Security] Detection rule monitoring" - Dashboard know can not be opened.  
I i try to select it in the menu the empty dashboard is shown and i can nearly catch an error in the lower right corner. Than the system is going back to the logon screen and constantly looping the same way.  
If i go into the gui via the regular login screen i can login.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [May 3, 2025, 7:12pm UTC](https://discuss.elastic.co/t/error-in-detection-rule-remote-computer-account-dnshostname-update/377772/9 "2025-05-03T19:12:11Z")

</div>

No, this is unrelated.

It may be another different issue.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 31, 2025, 7:12pm UTC](https://discuss.elastic.co/t/error-in-detection-rule-remote-computer-account-dnshostname-update/377772/10 "2025-05-31T19:12:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.