Hi, I created an indicator match rule using intel from the Recorded Future integration package v1.0.1. The match rule appears to be failing from the rule name itself. Here is the error output: Rule failure at Jul 8, 2022 @ 16:15:12.597 Bulk Indexing of signals failed: object mapping for [service]…

Yeah, the demo_ip index is what the rule is querying for alerts so it needs to be remapped to have a service field that is ECS compliant (ie that object I linked earlier)

Indicator Match Rule Failing from Rule Name

Elastic Security SIEM

system (system) Closed August 10, 2022, 10:44pm 8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Error in running Detection Rules Indicator Match Elasticsearch detection-rules	1	333	April 13, 2023
Indicator Match Detection Rule Error - indicators.map is not a function Kibana	9	819	September 8, 2021
Rules in ElasticSIEM not create signals SIEM	5	562	May 14, 2020
Indicator Match Detection Rule Not Matched and Mapped to Intel Feeds SIEM detection-rules	17	2454	April 1, 2021
Using "message" in custom alert rule SIEM	3	538	July 23, 2021

Indicator Match Rule Failing from Rule Name

Related topics