# External Alerts not showing up **URL:** \ **Category:** Elastic Security\ **Created:** [August 24, 2020, 4:14pm UTC](https://discuss.elastic.co/t/external-alerts-not-showing-up/246155 "2020-08-24T16:14:21Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Ameer\_Mukadam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ameer_mukadam/32/47196_2.png) [@Ameer\_Mukadam](https://discuss.elastic.co/u/Ameer_Mukadam)\ **Post date:** [August 24, 2020, 4:14pm UTC](https://discuss.elastic.co/t/external-alerts-not-showing-up/246155/1 "2020-08-24T16:14:21Z")
So with 7.9 elastic brought support for Sophos FW I quickly updated everything and started shipping logs using filebeat and everything seems to be working fine except 1 thing which is events from alert.kind: alert are generated when the fw detects malware in files which means it should show up on the external alerts widget in the SIEM app but it isn’t showing up there. ---
**Author:** ![Mike\_Paquette](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mike_paquette/32/119011_2.png) [@Mike\_Paquette](https://discuss.elastic.co/u/Mike_Paquette)\ **Post date:** [August 27, 2020, 12:27pm UTC](https://discuss.elastic.co/t/external-alerts-not-showing-up/246155/2 "2020-08-27T12:27:27Z")
Hi Ameer, thanks for your post. Let's try to find out why your Sophos FW alerts are not showing up in the external alerts widgets. I do not currently have access to Sophos logs to verify this behavior, so I am referencing the current documentation for the Filebeat Sophos Module here: [https://www.elastic.co/guide/en/beats/filebeat/7.9/filebeat-module-sophos.html](https://www.elastic.co/guide/en/beats/filebeat/7.9/filebeat-module-sophos.html) First, I noticed that you mentioned `alert.kind: alert`, but I think you mean `event.kind: alert`, is this correct? Next, there are three places in the 7.9 security app where the external alerts widget is used, and each has a slightly different query associated with it. 1. **Overview -\> External alerts:** We expect that all events with `event.kind: alert` to show up here. 2. **Hosts-\>External alerts:** Only external alerts that also include the `host.name` field will appear here. Generally, we would not expect network firewall alerts to be displayed in this instance of the External alerts widget. 3. **Network-\>External alerts:** External alerts that contain an IP address in the `source.ip` field will be displayed. I would expect your FW alerts to show up here. Can you clarify if your FW alerts appear in _any_ of the three locations? Also, can you verify whether you can see these FW Alerts elsewhere in the Security app, or elsewhere in Kibana, such as in Discover? ---
**Author:** ![Ameer\_Mukadam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ameer_mukadam/32/47196_2.png) [@Ameer\_Mukadam](https://discuss.elastic.co/u/Ameer_Mukadam)\ **Post date:** [August 27, 2020, 2:04pm UTC](https://discuss.elastic.co/t/external-alerts-not-showing-up/246155/3 "2020-08-27T14:04:42Z")
Hi Mike, Yes I meant to say event.kind: alert and yes I can see the events in the network tab which you mentioned, but not on the overview page also if I do the same query in Discover there are matching events. ![Capture](https://us1.discourse-cdn.com/elastic/original/3X/1/c/1c2a45885de31078b7a841d50bffbddbc2cb0cac.png) ---
**Author:** ![Frank\_Hassanabad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frank_hassanabad/32/49255_2.png) [@Frank\_Hassanabad](https://discuss.elastic.co/u/Frank_Hassanabad)\ **Post date:** [August 31, 2020, 3:59pm UTC](https://discuss.elastic.co/t/external-alerts-not-showing-up/246155/4 "2020-08-31T15:59:19Z")
Clicking the request magnifier glass next to the query: ![Screen Shot 2020-08-31 at 9.57.36 AM](https://us1.discourse-cdn.com/elastic/original/3X/3/9/39c92b82e2ed7e6885629a795159d4596d7a1b67.png) ! [Screen Shot 2020-08-31 at 9.57.44 AM|690x490](https://discuss.elastic.co/uploads/short-url/drUKHBWHi2jTT5rWHnckH6i2fNG.png) I see this query below. Do you have `host.name` in your events? : ```auto { "aggregations": { "alertsGroup": { "terms": { "field": "event.module", "missing": "All others", "order": { "_count": "desc" }, "size": 10 }, "aggs": { "alerts": { "date_histogram": { "field": "@timestamp", "fixed_interval": "2700000ms", "min_doc_count": 0, "extended_bounds": { "min": 1598802998148, "max": 1598889398148 } } } } } }, "query": { "bool": { "filter": [ { "bool": { "must": [], "filter": [ { "match_all": {} }, { "bool": { "filter": [ { "bool": { "should": [ { "exists": { "field": "host.name" } } ], "minimum_should_match": 1 } } ] } } ], "should": [], "must_not": [] } }, { "bool": { "filter": [ { "bool": { "should": [ { "match": { "event.kind": "alert" } } ], "minimum_should_match": 1 } } ] } }, { "range": { "@timestamp": { "gte": "2020-08-30T15:56:38.148Z", "lte": "2020-08-31T15:56:38.148Z", "format": "strict_date_optional_time" } } } ] } }, "size": 0, "track_total_hits": true } ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 4, 2022, 8:11am UTC](https://discuss.elastic.co/t/external-alerts-not-showing-up/246155/5 "2022-11-04T08:11:12Z")