Rule Failure

Elastic Security
1

Hi,
I have the following rule failure:

/An error occurred during rule execution: message: "verification_exception
Root causes:
verification_exception: Found 1 problem
line 3:3: Unknown column [winlog.event_data.AttributeLDAPDisplayName], did you mean [winlog.event_data.AttributeValue]?"

I am unsure on how to correct this. Any ideas?
Thanks

2

Hi @ETFJeff , welcome to out community.

Have you verified Field Names in the Index Pattern?

  • Go to Kibana and navigate to Stack Management > Index Patterns.
  • Find the index pattern that your rule is querying against (likely something like winlogbeat-* if you’re using Winlogbeat).
  • Check if the field winlog.event_data.AttributeLDAPDisplayName actually exists.
3

Hi,

Thanks. Glad to be working in Elastic but also I am very new so I have to admit I am quite challenged.

I think Index Patterns is not called Data Views?

I looking in Data Views and the field `winlog.event_data.AttributeLDAPDisplayName does not exist there.```

``

What are my options to correct this? Should I try to remove the field from the query or add the field to the data view?

Sorry I am very new to elastic so not familiar with best ways to correct issues like this.

Thanks

Jeff

1 Like
4

Hey @ETFJeff, apologies for the delay in responding. The warning message indicates that no events containing this field have been ingested yet. Since most fields under winlog.event_data.* are dynamically parsed, the field will only appear in the mapping once a document with that field is ingested.

This field is associated with Active Directory monitoring. I would evaluate if it is relevant to your environment. If it is, you can find setup instructions for enabling the necessary audit policies on your domain controllers in the Setup section. If it's not relevant, you may want to consider disabling the rule.

5

Issues related to detection rules can be brought more directly to the responsible team attention by opening an issue in our github repo: Issues · elastic/detection-rules · GitHub

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.