# Missing index .siem-signals-default **URL:** \ **Category:** SIEM\ **Created:** [February 28, 2022, 9:48pm UTC](https://discuss.elastic.co/t/missing-index-siem-signals-default/298452 "2022-02-28T21:48:51Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![slash24](https://avatars.discourse-cdn.com/v4/letter/s/a4c791/32.png) [@slash24](https://discuss.elastic.co/u/slash24)\ **Post date:** [February 28, 2022, 9:48pm UTC](https://discuss.elastic.co/t/missing-index-siem-signals-default/298452/1 "2022-02-28T21:48:51Z")
Having 7.16.3 properly licensed with Platinum, I cannot run some (tried five) ML-rules from Security due to: ".siem-signals-default" missing. I have Elastic Agent deployed with Security Endpoint activated and lots of data in logs-\* `An error occurred during rule execution: message: "windows_rare_metadata_user,v2_windows_rare_metadata_user missing" name: "Unusual Windows User Calling the Metadata Service" id: "0f1f529c-79e7-11ec-8cb2-a14d75db9d36" rule id: "df197323-72a8-46a9-a08e-3f5b04a4a97a" signals index: ".siem-signals-default"` ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [February 28, 2022, 9:59pm UTC](https://discuss.elastic.co/t/missing-index-siem-signals-default/298452/2 "2022-02-28T21:59:00Z")
Welcome to our community! 😃 > [@slash24](#): > > Having 7.16.3 properly licensed with Platinum I would encourage you to open a Support request, as you're entitled to that with that license. ---
**Author:** ![slash24](https://avatars.discourse-cdn.com/v4/letter/s/a4c791/32.png) [@slash24](https://discuss.elastic.co/u/slash24)\ **Post date:** [February 28, 2022, 11:11pm UTC](https://discuss.elastic.co/t/missing-index-siem-signals-default/298452/3 "2022-02-28T23:11:28Z")
Trust me, I'm giving support a hard time with many of my newbie-questions. Just evaluating if the forums are candidates for quicker answers for non-critical matters ---
**Author:** ![spong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spong/32/54343_2.png) [@spong](https://discuss.elastic.co/u/spong)\ **Post date:** [March 2, 2022, 8:47pm UTC](https://discuss.elastic.co/t/missing-index-siem-signals-default/298452/4 "2022-03-02T20:47:53Z")
Hey there @slash24! 👋 Sorry about the confusion here -- looks like that error message isn't helpful enough. Your signals index isn't actually missing, but rather one of the ML Jobs on that Rule isn't installed. In this case it looks like `missing` is added next to the job in question: `v2_windows_rare_metadata_user missing`. To resolve, you can use the `ML Job Settings` UI to install the `v2_windows_rare_metadata_user` Job, or if you don't care about that Job and are just using `windows_rare_metadata_user`, you can clone the Rule and just remove the other Job by editing the Rule. ![Rules_-_Kibana](https://us1.discourse-cdn.com/elastic/original/3X/c/2/c22fd3700c16bb17752a62b06bcf894f1b5fd7bc.png) I've created [this issue](https://github.com/elastic/kibana/issues/126723) for improving the error messaging here -- hope this helps! 🙂 Cheers! Garrett ---
**Author:** ![slash24](https://avatars.discourse-cdn.com/v4/letter/s/a4c791/32.png) [@slash24](https://discuss.elastic.co/u/slash24)\ **Post date:** [March 7, 2022, 7:38pm UTC](https://discuss.elastic.co/t/missing-index-siem-signals-default/298452/5 "2022-03-07T19:38:50Z")
Thanks a lot for the effort! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 4, 2022, 7:39pm UTC](https://discuss.elastic.co/t/missing-index-siem-signals-default/298452/6 "2022-04-04T19:39:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.