Feature request?

Elastic Security SIEM
1

Hey,
I notices that our siem app has alot of missing features, like the counting query, can we have that like query something then if it pass a threashold then create a detection signal. Since only having able to query the log file to search for something but not how many time they apear is not really useful.
I know that i can use watcher to do that but watcher does not generate signal for me.

Thank.

2

Hi @lusynda! Threshold-based Rules are currently under development and should be available soon. Follow that issue for updates, and please keep the suggestions and use cases coming! Knowing our users' needs keeps our products great.

Thanks,

--
Ryland