# Prebuilt security rule not working with fleet architecture

**URL:** <https://discuss.elastic.co/t/prebuilt-security-rule-not-working-with-fleet-architecture/336779>\
**Category:** Elastic Agent\
**Tags:** detection-rules\
**Created:** [June 23, 2023, 2:16pm UTC](https://discuss.elastic.co/t/prebuilt-security-rule-not-working-with-fleet-architecture/336779 "2023-06-23T14:16:31Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![kfdl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kfdl/32/122642_2.png) [@kfdl](https://discuss.elastic.co/u/kfdl)\
**Post date:** [June 23, 2023, 2:16pm UTC](https://discuss.elastic.co/t/prebuilt-security-rule-not-working-with-fleet-architecture/336779/1 "2023-06-23T14:16:31Z")

</div>

Hello All,

first of all thank you for this product, your support and your time. 🙂

I am using the Elastic Stack for a couple month to gather all the logs of my servers and i'm using the fleet server to enroll all of my elastic agent. Everything is working fine except for the prebuilt rules.

I installed all the prebuilt rule in kibana and I enabled all the rules. But I have nothing even when I try the trigger an alert myself.

After some investigation it seems like the rules are using the wrong index pattern (because I use elastic agent):

 ![index pattern in the rule](https://us1.discourse-cdn.com/elastic/original/3X/0/3/037b025dff89f1b4086152b246e59b68002b15c2.jpeg)

but the index that I have with the elastic agent are like **logs-elastic\_agent.** \*

So do you know if it is an error or if I have to duplicate all the rule myself and change the configuration or If can do anything else?

Thank you for your help 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 21, 2023, 2:17pm UTC](https://discuss.elastic.co/t/prebuilt-security-rule-not-working-with-fleet-architecture/336779/2 "2023-07-21T14:17:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
