Hello, when I create an Indicator Match detection rule using an uploaded value list (following instructions from Create a detection rule | Elastic Security Solution [8.11] | Elastic ), the rule fails to execute with the following error: An error occurred during rule execution: message: "search_phas…

Indicator Match detection rules using Value Lists not working in 8.6.0

Nikita_Khristinin (Nikita Khristinin) January 18, 2023, 11:36am 2

Hey, can you share your rule configuration?

One possible error can be if you use .items-* instead of .items-${spaceName} (.items-default for example)

1 Like

Topic		Replies	Views
Elastic detection rules fail Elastic Security detection-rules	2	891	June 30, 2023
Indicator Match Detection Rule Not Matched and Mapped to Intel Feeds SIEM detection-rules	17	2501	April 1, 2021
Indicator Match Rule Failing from Rule Name SIEM elastic-stack-alerting	7	683	August 10, 2022
Indicator Match Detection Rule Error - indicators.map is not a function Kibana	9	839	September 8, 2021
Detection Rules Fail Index issues Elastic Security	9	2912	November 4, 2022