# Problem with Detections - Custom query rule **URL:** \ **Category:** SIEM\ **Created:** [August 5, 2022, 1:39pm UTC](https://discuss.elastic.co/t/problem-with-detections-custom-query-rule/311543 "2022-08-05T13:39:04Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![Yuriy\_Tsarenko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuriy_tsarenko/32/72763_2.png) [@Yuriy\_Tsarenko](https://discuss.elastic.co/u/Yuriy_Tsarenko)\ **Post date:** [August 5, 2022, 1:39pm UTC](https://discuss.elastic.co/t/problem-with-detections-custom-query-rule/311543/1 "2022-08-05T13:39:05Z")
Good afternoon dear community. I turn to you with the following problem. The custom rule does not create security alerts, although it works without visible errors. Kibana Version: 8.3.1 Rule type: custom query. Rule query: event.category : "network" and event.type : "connection" and destination.domain : "[protey.net](http://protey.net)" Index patterns: filebeat-\* logs-\* packetbeat-\* winlogbeat-\* Rule preview: ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/0/203f6de5e01a6b1ec3611e435e4dbec039a1934b.png) Rule execution logs: ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/b/fb31056af464cafbc18587db1f057c993b5b91bf.png) Please advise me what I am doing wrong. Thanks for any help. ---
**Author:** ![Nikita\_Khristinin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikita_khristinin/32/102092_2.png) [@Nikita\_Khristinin](https://discuss.elastic.co/u/Nikita_Khristinin)\ **Post date:** [August 8, 2022, 10:05am UTC](https://discuss.elastic.co/t/problem-with-detections-custom-query-rule/311543/2 "2022-08-08T10:05:25Z")
Hello @Yuriy_Tsarenko Can you share what is your interval and lookback time for a rule? Maybe the reason that preview tries to find alerts for the last hour, but the default interval is 5 minutes + 1-minute look back time ![Screenshot 2022-08-08 at 12.04.18](https://us1.discourse-cdn.com/elastic/original/3X/b/b/bb0c68ade6cb7cbaccb6594bc99799afd1f4d4ba.png) ---
**Author:** ![Yuriy\_Tsarenko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuriy_tsarenko/32/72763_2.png) [@Yuriy\_Tsarenko](https://discuss.elastic.co/u/Yuriy_Tsarenko)\ **Post date:** [August 8, 2022, 10:24am UTC](https://discuss.elastic.co/t/problem-with-detections-custom-query-rule/311543/3 "2022-08-08T10:24:29Z")
Hi @Nikita_Khristinin I set the time interval like this: ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/e/4ece085c57f9ef49efd4fedc666ca3791983da3d.png) ---
**Author:** ![Nikita\_Khristinin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikita_khristinin/32/102092_2.png) [@Nikita\_Khristinin](https://discuss.elastic.co/u/Nikita_Khristinin)\ **Post date:** [August 8, 2022, 10:38am UTC](https://discuss.elastic.co/t/problem-with-detections-custom-query-rule/311543/4 "2022-08-08T10:38:59Z")
So are you sure that you have some events on that interval+look-back time? As for a test you can increase your look-back time and check if it catches the old events. But for the real use case, you probably don't want the very big look-back time (because it will reprocess all old queries for each execution) ---
**Author:** ![Yuriy\_Tsarenko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuriy_tsarenko/32/72763_2.png) [@Yuriy\_Tsarenko](https://discuss.elastic.co/u/Yuriy_Tsarenko)\ **Post date:** [August 9, 2022, 9:45am UTC](https://discuss.elastic.co/t/problem-with-detections-custom-query-rule/311543/5 "2022-08-09T09:45:45Z")
Oh sure. I generate events, and I specifically wait for the rule to be worked out. It is noteworthy that the correlation rules work properly, those that I created myself. ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/9/495f7da479c77c1805481533cbe3faa4f783c013.png) But custom query - not created alerts. But i see this events in Discover: ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/6/26ca67026c38e71520b763ced57b6be07a6f8cc3.png) ---
**Author:** ![Nikita\_Khristinin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikita_khristinin/32/102092_2.png) [@Nikita\_Khristinin](https://discuss.elastic.co/u/Nikita_Khristinin)\ **Post date:** [August 9, 2022, 1:09pm UTC](https://discuss.elastic.co/t/problem-with-detections-custom-query-rule/311543/6 "2022-08-09T13:09:03Z")
Yes, it's really interesting. Just to be sure: - Rule executed successfully, but no alerts are generated? - You don't have any filters in the query bur on the rule page? (can lead to filtering events) Can you maybe send the screenshot of your rule, so that I can see the configuration? ---
**Author:** ![Yuriy\_Tsarenko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuriy_tsarenko/32/72763_2.png) [@Yuriy\_Tsarenko](https://discuss.elastic.co/u/Yuriy_Tsarenko)\ **Post date:** [August 9, 2022, 2:24pm UTC](https://discuss.elastic.co/t/problem-with-detections-custom-query-rule/311543/7 "2022-08-09T14:24:31Z")
Answering your question: - Rule executed successfully, but no alerts are generated? Yes: ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/0/10b675918579d1b1411902d0f50613bf98372c29.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/0/00f538dd92741fa0c4ddb329fe25824f001046c8.png) - You don't have any filters in the query bur on the rule page? (can lead to filtering events) No: ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/e/ce8376705277f3760e061f1114c9ca2db14bfbbe.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/d/8d4f2d3be158964af50e4b59feaf74d653dc9154.png) ---
**Author:** ![Nikita\_Khristinin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikita_khristinin/32/102092_2.png) [@Nikita\_Khristinin](https://discuss.elastic.co/u/Nikita_Khristinin)\ **Post date:** [August 10, 2022, 10:54am UTC](https://discuss.elastic.co/t/problem-with-detections-custom-query-rule/311543/8 "2022-08-10T10:54:18Z")
Yes, it's quite strange if you don't see any alerts in the rule, but see events in discovery for this time range. Maybe it can be a good idea to debug this rule, it's a create a several a new one which contains only part of query like: `event.category : "network"`. Then you can see which rule has alerts, and which hasn't and maybe it five you the clue ---
**Author:** ![Mike\_Paquette](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mike_paquette/32/119011_2.png) [@Mike\_Paquette](https://discuss.elastic.co/u/Mike_Paquette)\ **Post date:** [August 10, 2022, 4:02pm UTC](https://discuss.elastic.co/t/problem-with-detections-custom-query-rule/311543/9 "2022-08-10T16:02:34Z")
Hi @Yuriy_Tsarenko, Sorry you are having trouble with your custom query rule producing expected alerts. As a test, I created a similar rule on my 8.3.3 system, and it seems to be working fine for me. I have an alert for every document that appears in Discover. I am not aware of any query behavior differences between 8.3.1 and 8.3.3. Here is my rule (of course, its query contains a different value of `destination.domain`), but is otherwise identical to your rule query ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/1/318b61e62843772938d3954918ed3c9b1a593ab3.jpeg) You can see over the past 56 hours, it generated 169 alerts, one for each document that matches the query. It runs every 5 minutes with 1 min additional look-back time. ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/8/283444356eef7d8260917bf897674fb91ceca74f.jpeg) Here is Discover over the same time period, by taking the rule query, and just pasting it into the KQL query bar. You can see I also get 169 documents. ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/c/5ceb5d5679c2b8c3e8e641b85ba6cf7957b6dd32.jpeg) So I can't see anything wrong with your query. One possibility 💡 is what @Nikita_Khristinin suggested earlier. Is there any chance that your data is delayed significantly before it is ingested into Elasticsearch? If it were delayed more than 9 minutes, then your rule query would "miss" it. Sometimes these delays can be caused by external queuing systems, or system clocks that are out of synchronization, or other conditions. 💡 As a test to rule this out, can you modify your rule to have an additional look-back time of 20 minutes? And let us know if this makes a difference? Thanks! ---
**Author:** ![Yuriy\_Tsarenko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuriy_tsarenko/32/72763_2.png) [@Yuriy\_Tsarenko](https://discuss.elastic.co/u/Yuriy_Tsarenko)\ **Post date:** [August 11, 2022, 12:24pm UTC](https://discuss.elastic.co/t/problem-with-detections-custom-query-rule/311543/10 "2022-08-11T12:24:47Z")
Thank you very much for your help and advice. The problem was solved, but I can not unequivocally point to its causes. Steps: - ``` Updated time sync. ``` - ``` Deleted my rule. ``` - ``` Created a new one, but without specifying the domain. ``` And alerts began to come, just before that, all services and the server itself were restarted. Something subtly influenced the fact that the rule did not work correctly. Next, I added the domain to the request, and continued to receive alerts properly. ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/e/eec37a74f57ada5a6b99a6560523b52534e4e1f1.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/0/c04bd6eb6d36ffd498eff0611316fcbe1657888e.png) Kibana Version: 8.3.1 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 8, 2022, 12:24pm UTC](https://discuss.elastic.co/t/problem-with-detections-custom-query-rule/311543/11 "2022-09-08T12:24:57Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.