Issue with Signals in ELK7.8

Elastic Security SIEM
1

Hi,

I have 200 rule signals running. There are 80 Elastic default rules and 120 custom rules.

Last response of most of the rules are showing succeeded but last run is 6 days ago and more. There is no error message.

Please help me to resolve this issue.

2

Hi @jancodenew ,

Thanks for posting. It may be helpful to get more details on one of the rules you're seeing this happen for to better triage.

  • Are the rules you are seeing run as "[ X ] days ago" prepackaged, custom or are you seeing it occur for both?
  • What sort of interval is set on the rule?
  • Are there any messages under the rule details Failure History tab?
  • Has it previously successfully generated alerts?
  • If you disable and re-enable one of these rules, do you see any failures?

I believe it was in 7.9+ that we addressed some feedback to make triaging such situations easier. If possible to do so, it could be helpful to update to the latest version.

3

Replied inline. Please check,

4

Hi @jancodenew -

Apologies for the delayed response. Are you continuing to encounter this issue? What were some of the failure messages you mentioned appeared under the rule details of some of the rules that appear to not have run for a long time?

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.