Hello, There seem to be quite a bit of unmapped fields in .siem-signals-default index. I tried refreshing the index pattern, but the fields are not added. The result is I can't use certain fields: [image] For example a search for transaction.type: request Doesn't give me any results. These fie…

Hi @willemdh , In detection engine we do not add the ECS extended fields as part of the mapping such as parts of the transaction ones: https://www.elastic.co/guide/en/ecs/current/ecs-tracing.html However, if you want them indexed you can add them either directly or better yet to the template so th…

@Frank_Hassanabad Tx for the detailed explanation. I'm considering going down the following road (which I'm doing for beat indices too for multiple years and survives updates) Create an 'overrides' template and add custom and extended fields there which points to the ".siem-signals-default-*" index…

Lots of unmapped fields in .siem-signals-default

Elastic Security SIEM

Frank_Hassanabad (Frank Hassanabad) April 24, 2020, 1:56pm 4

That's not a bad idea. In the code we always look for .siem-signals-${space-id} such as .siem-signals-default within SIEM if that helps you out planning a strategy.

Happy to hear you're a very experienced beats person!

Topic		Replies	Views
SIEM Signals not triggering SIEM	11	1041	December 7, 2020
Signal Field Schema Documentation SIEM detection-rules	1	579	July 1, 2021
Trouble with Index Patterns SIEM	13	3915	August 2, 2019
What field are used to populate the entire SIEM APP SIEM ecs-elastic-common-schema	3	957	December 31, 2019
Filebeat module's fields in SIEM columns SIEM	2	446	April 2, 2021

Lots of unmapped fields in .siem-signals-default

Related topics