# How to change the External alert trend request **URL:** \ **Category:** Elastic Security\ **Created:** [January 21, 2022, 7:06pm UTC](https://discuss.elastic.co/t/how-to-change-the-external-alert-trend-request/295094 "2022-01-21T19:06:31Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![wsouza](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wsouza/32/92547_2.png) [@wsouza](https://discuss.elastic.co/u/wsouza)\ **Post date:** [January 21, 2022, 7:06pm UTC](https://discuss.elastic.co/t/how-to-change-the-external-alert-trend-request/295094/1 "2022-01-21T19:06:31Z")
Guys, I need to change the information on the External alert trend dashboard, however, I can't find the place to change the requests. The image shows what I want to change. ![img1](https://us1.discourse-cdn.com/elastic/original/3X/9/4/947825e492c7bd9c0005193fbadbe714c459eb55.png) ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [January 23, 2022, 1:28am UTC](https://discuss.elastic.co/t/how-to-change-the-external-alert-trend-request/295094/2 "2022-01-23T01:28:24Z")
Hi @wsouza Welcome to the community. (and by the way we are not all guys 🙂 ) We are going to need a bit more information. What version of stack? Which Module, Dashboard / Visualization? Or is this one of the built in app like the Security Analytics App.. Perhaps a screen shot would help. What do you want to change it to? If this is the security app, you will probably need to map your data to the correct ECS field not change the underlying app. If it a dashboard under the Dashboards navigation.. In general you can edit any visualization on a Dashboard by Clicking the edit button top right. Then click on the gear on the specific visualization and select edit. Depending on the type of visualization Lens, TSVB etc there would be different options to make changes. Also you can always just create your own visualization. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [January 23, 2022, 4:51pm UTC](https://discuss.elastic.co/t/how-to-change-the-external-alert-trend-request/295094/3 "2022-01-23T16:51:30Z")
Ahh I think that is from this Built In App / Dashboard ![Screen Shot 2022-01-23 at 8.45.57 AM](https://us1.discourse-cdn.com/elastic/original/3X/7/2/72726f491f685b3b275653c94f6fabd742bef0d4.jpeg) For the Security App you will need to follow the Security ECS (Elastic Common Schema) for you fields, you can not change the Built In App See [Here](https://www.elastic.co/guide/en/security/current/siem-field-reference.html#_event_and_external_alert_fields) and specifically here These fields must be mapped to display event and external alert data in the Elastic Security app: > ## Event and external alert fields > > - `@timestamp` > - `event.kind` > > For external alerts, the `event.kind` field value must be `alert` . To do this you simply need to map / set the `event.kind` to `alert` Depending on how you are ingesting these aleert we could probably help with how to set that ... ingest pipeline, logstash, simply set in the REST API etc. ---
**Author:** ![wsouza](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wsouza/32/92547_2.png) [@wsouza](https://discuss.elastic.co/u/wsouza)\ **Post date:** [January 24, 2022, 5:58pm UTC](https://discuss.elastic.co/t/how-to-change-the-external-alert-trend-request/295094/4 "2022-01-24T17:58:58Z")
Hi, @stephenb!. I had uploaded the dashboard screen, but I don't think it's visible here on the forum. In fact, it would be that same panel you mentioned. In mine, event.kind is already as "alert", however, my question is how to generate this type of event. For monitoring my hosts, I use the beats: winlogbeat, metricbeat, filerbeat and packetbeat. In another environment, I use the Elastic Security Agent and manage it through the fleet server. In the created indexes, none match the event.kind field: "alert". That's what I find strange. That's why I wanted to change the settings of the aforementioned dashboard to see if it populated with other events. I'll keep trying some other possibilities to see if I'm successful. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [January 24, 2022, 6:18pm UTC](https://discuss.elastic.co/t/how-to-change-the-external-alert-trend-request/295094/5 "2022-01-24T18:18:31Z")
> [@wsouza](#): > > In mine, event.kind is already as "alert", however, my question is how to generate this type of event. Ok so that is a completely different question 🙂 you will need to used the Detections Etc to create Alerts etc . I would create a new thread with the Title something Like > How do I create External Alerts in the Security App and the state the sources you are ingesting etc. Here are the docs on Detections and Alerts > **[Detections and alerts | Elastic Security Solution \[8.11\] | Elastic](https://www.elastic.co/guide/en/security/current/detection-engine-overview.html)** Here is the docs on Generating External Alerts from other sources I believe there is a preconfigured rule that you would need to enable etc... > **[External Alerts | Elastic Security Solution \[8.11\] | Elastic](https://www.elastic.co/guide/en/security/current/external-alerts.html)** ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 21, 2022, 6:19pm UTC](https://discuss.elastic.co/t/how-to-change-the-external-alert-trend-request/295094/6 "2022-02-21T18:19:24Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.