# Match rule not working **URL:** \ **Category:** SIEM\ **Tags:** elastic-stack-alerting\ **Created:** [March 9, 2021, 9:44am UTC](https://discuss.elastic.co/t/match-rule-not-working/266666 "2021-03-09T09:44:49Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![TheHunter1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thehunter1/32/80190_2.png) [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Post date:** [March 9, 2021, 9:44am UTC](https://discuss.elastic.co/t/match-rule-not-working/266666/1 "2021-03-09T09:44:49Z")
Hello, I am trying to add a threat intelligence in my SIEM, I downloaded the database of malware hashes, and I am using auditbeat file integrity to detect malware, and then I created a rmatch rule like that: ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/d/7d33f5911d0f2b59a9486e0aa4238a95f54d1342.png) and then I download a malware in my windows machine, and as we can see, when I filter by it's hash I can see it in auditbeat discover : ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/a/7ae2fe10945e88b8de75b3f05e83526cd191470b.png) and we can also see it in my malware database: ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/a/6a6916f1bffeaf2a49a592f1b82c1d701819fcd0.png) But when the rule executes, It didn't generate any alert ! (we can see that the rule succeeded) ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/1/717bb0d3c9e180b8aabfcb17228efc0b453f443e.png) Could you please explain to me why this is happening ? Best regards ---
**Author:** ![Mike\_Paquette](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mike_paquette/32/119011_2.png) [@Mike\_Paquette](https://discuss.elastic.co/u/Mike_Paquette)\ **Post date:** [March 9, 2021, 12:10pm UTC](https://discuss.elastic.co/t/match-rule-not-working/266666/2 "2021-03-09T12:10:42Z")
Hi there @TheHunter1, Great to see you trying out the indicator match rule type! Your rule config looks good to me. Here are a couple of things to check: 1. Is your threat indicator field `sha1_hash` a _keyword_ ? 2. What is the schedule for this rule (i.e. "Runs every" and "Additional look-back time") ? Also, you mentioned that you can see that the rule succeeded (that's good!), could you send along a snapshot of the "Rule Monitoring" tab like this? ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/8/b8f8b2e82498693ad742563c20a61221afe0d58c.jpeg) Out of curiosity, how many documents do you have in our `bazaar-*` index pattern? Thanks! ---
**Author:** ![TheHunter1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thehunter1/32/80190_2.png) [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Post date:** [March 9, 2021, 1:06pm UTC](https://discuss.elastic.co/t/match-rule-not-working/266666/3 "2021-03-09T13:06:27Z")
Thanks for your answers @Mike_Paquette , To answer your questions: 1- Yes the threat indicator field `sha1_hash` is a `keyword` as you can see in this pic : ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/1/015dc75ced3763f2743d770f649304e77c417ce0.png) 2- The schedule rule is `Run every 5min`and `additional look-back: 5min` (it was 1 min, and as it didn't send any alert I made it 5 min to ensure that I have no data loss, but still no alerts) 3- Here is a screenshot of the `Detection Rules monitorinf` section (The last one in the screenshot) : ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/4/a4ec8a3f1e95e3985ef93ad3cfc279ffcbd4724e.png) 4- In the `bazaar-*` index pattern, I have `274247` documents ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/4/74748c2cc67856c14072ce1b375f288c9bc0bb99.png) ---
**Author:** ![Frank\_Hassanabad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frank_hassanabad/32/49255_2.png) [@Frank\_Hassanabad](https://discuss.elastic.co/u/Frank_Hassanabad)\ **Post date:** [March 9, 2021, 4:53pm UTC](https://discuss.elastic.co/t/match-rule-not-working/266666/4 "2021-03-09T16:53:19Z")
I just ran a quick test using an index that looks similar and I was able to get matches. I just did the following in dev tools and choose one of my hashes: ```auto PUT bazaar-00001 PUT bazaar-00001/_mapping { "properties": { "@timestamp": { "type": "date" }, "sha1_hash": { "type": "keyword" } } } PUT bazaar-00001/_doc/1 { "@timestamp": "2021-03-09T16:43:21.757Z", "sha1_hash": "ad2aaef284522469b03fb9c019be71e0fed70bec" } ``` And then used this definition: ![Screen Shot 2021-03-09 at 9.48.34 AM](https://us1.discourse-cdn.com/elastic/original/3X/5/d/5d94903d0661d9b260004b8d53d786d5335f7bf1.png) And I was getting hits. What do all your `@timestamps` in your list look like? Are they unique or identical? We currently sort in the list against the timestamp and then we pull them in sections by using a `search_after` when the lists begin exceeding 9k. If all the `@timestamps` are identical in the list, that would be a problem. The Query time for `malware_hash_bazaar` looks rather almost too quick for a list that size. ---
**Author:** ![TheHunter1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thehunter1/32/80190_2.png) [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Post date:** [March 10, 2021, 7:54am UTC](https://discuss.elastic.co/t/match-rule-not-working/266666/5 "2021-03-10T07:54:19Z")
Thanks for your answer @Frank_Hassanabad , I just checked the `@timestamp` in my `bazaar-*` index pattern, and they look almost the same (some lines different in the milisecondes: like `Mar 9, 2021 @ 17:34:41. **006** `: ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/2/d271729fd48dcb8b9775be6481cadbc2fbd98855.png) How can I solve this problem in this case ? should I replace the timestamp by the field `first_seen` in the bazaar database ? Thanks for your help ---
**Author:** ![Frank\_Hassanabad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frank_hassanabad/32/49255_2.png) [@Frank\_Hassanabad](https://discuss.elastic.co/u/Frank_Hassanabad)\ **Post date:** [March 10, 2021, 4:48pm UTC](https://discuss.elastic.co/t/match-rule-not-working/266666/6 "2021-03-10T16:48:28Z")
Anything which makes each `@timestamp` unique would be good. If `@timestamp` is the exact same across records, that's when you can have a miss when the size grows larger than 9k in size. If `first_seen` is unique that should work out. We loop over the entire lists each time if your query is `*:*`. We are having discussions of not making `@timestamp` mandatory for lists in the future as some people have complained about its mandatory nature and gotcha's like this. We might use something other than the `search_after` such as one of the live cursors but if the cursor times out in-between list items due to slow querying then we would just end up replacing one bug with another. But I'm hopeful we can remove more gotcha's here soon. ---
**Author:** ![TheHunter1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thehunter1/32/80190_2.png) [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Post date:** [March 11, 2021, 8:51am UTC](https://discuss.elastic.co/t/match-rule-not-working/266666/7 "2021-03-11T08:51:25Z")
Thanks for your answers @Frank_Hassanabad, I will try to change the `@timestamp` and keep you updated 😊 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 8, 2021, 8:52am UTC](https://discuss.elastic.co/t/match-rule-not-working/266666/8 "2021-04-08T08:52:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.