# Machine Learning rule does not trigger while

**URL:** <https://discuss.elastic.co/t/machine-learning-rule-does-not-trigger-while/357147>\
**Category:** Elastic Security\
**Created:** [April 10, 2024, 1:00pm UTC](https://discuss.elastic.co/t/machine-learning-rule-does-not-trigger-while/357147 "2024-04-10T13:00:27Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Poukim0m](https://avatars.discourse-cdn.com/v4/letter/p/898d66/32.png) [@Poukim0m](https://discuss.elastic.co/u/Poukim0m)\
**Post date:** [April 10, 2024, 1:00pm UTC](https://discuss.elastic.co/t/machine-learning-rule-does-not-trigger-while/357147/1 "2024-04-10T13:00:28Z")

</div>

Hello,

i have created a machine learning job and i have selected this job in the correspondent machine learning rule in Security-\>Rules-\> Detection Rules and have added as action a notification to my e-mail.  
I have also set up a notification email on the machine learning job level.

However i am not receiving any notification from the ML rule. I am receiving notification only from the job.  
Have you got any idea why this happens?

Thank you in advance,  
Vivian

---

<div class="post-metadata">

**Author:** ![Maxim\_Palenov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maxim_palenov/32/122504_2.png) [@Maxim\_Palenov](https://discuss.elastic.co/u/Maxim_Palenov)\
**Post date:** [April 10, 2024, 7:32pm UTC](https://discuss.elastic.co/t/machine-learning-rule-does-not-trigger-while/357147/2 "2024-04-10T19:32:30Z")

</div>

Hi @Poukim0m,

There are multiple reasons why you don't receive notification emails. You need to make sure the following

- Alerts are generated by the rule. Actions get triggered for alerts generated by the rule. If there are no alerts no actions will be triggered.
- There is a properly configured email connector. You can send a test email to make sure credentials are correct and connectors works as expected.
- An email action using the mentioned connector is added to the rule and rule saved so you can see the added action on the rule details page
- Rule is not snoozed. [Rule snoozing](https://www.elastic.co/guide/en/kibana/current/create-and-manage-rules.html#controlling-rules) disables actions. While rule is snoozed actions won'e be triggered for generated alerts.

Let me know if it didn't help.

---

<div class="post-metadata">

**Author:** ![Poukim0m](https://avatars.discourse-cdn.com/v4/letter/p/898d66/32.png) [@Poukim0m](https://discuss.elastic.co/u/Poukim0m)\
**Post date:** [April 19, 2024, 12:17pm UTC](https://discuss.elastic.co/t/machine-learning-rule-does-not-trigger-while/357147/3 "2024-04-19T12:17:26Z")

</div>

Hi Maxim.

Thank you for your response.  
I receive alerts from jobs but at the same time alerts are not created by the corresponding rule.

Is there something more to check? Because it does not make sense

---

<div class="post-metadata">

**Author:** ![Poukim0m](https://avatars.discourse-cdn.com/v4/letter/p/898d66/32.png) [@Poukim0m](https://discuss.elastic.co/u/Poukim0m)\
**Post date:** [April 24, 2024, 8:04am UTC](https://discuss.elastic.co/t/machine-learning-rule-does-not-trigger-while/357147/4 "2024-04-24T08:04:11Z")

</div>

Hello, just to let you know that after attending an elastic workshop i was able to find the solution to this. I had to widen the lookback time of the detection rule.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 22, 2024, 8:04am UTC](https://discuss.elastic.co/t/machine-learning-rule-does-not-trigger-while/357147/5 "2024-05-22T08:04:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.