Log Source Stopped Working

[val (Val Crettaz)]

Hey, here is a question on a similar topic that has a good answer

Alerting when data stops coming in from variety of sources

I've had some issues in the past while trying to use the built-in threshold alert, it missed the alerts a lot of time, generated some false positive about the data recovering when it didn't recover. Afte some tickets with support with no solution and they not being able to replicated we gave up and looked for other ways to alert on the data. What solved our problem was using ES|QL security rules that will trigger based on the difference from the time when the rule is executed and the last even…