Help with EQL Rule to Detect Unauthorized State Transitions for Traffic Lights

Elastic Security
4

@Kuly2Fraise this may be due to the hyphen in the field name (best practices:wink: ); try escaping the fieldname with backticks.

Regarding the "empty response:"

  1. Can you please share the full query that you're using?
  2. Have you eliminated any broader issues like missing/conflicting mappings? Are you able to e.g. retrieve results with sequence [any where event.light_state != null] [any where event.light_state != null]
  3. Can you verify that the data contains the sequence that you're looking for? Remember that they have to be sequential by @timestamp, and (now) contain the same event.wlan-src key.
1 Like