# Rule for Applocker

**URL:** <https://discuss.elastic.co/t/rule-for-applocker/334299>\
**Category:** Elastic Security\
**Created:** [May 25, 2023, 9:18am UTC](https://discuss.elastic.co/t/rule-for-applocker/334299 "2023-05-25T09:18:20Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Leitner](https://avatars.discourse-cdn.com/v4/letter/l/e9bcb4/32.png) [@Leitner](https://discuss.elastic.co/u/Leitner)\
**Post date:** [May 25, 2023, 9:18am UTC](https://discuss.elastic.co/t/rule-for-applocker/334299/1 "2023-05-25T09:18:20Z")

</div>

Hi,

first of all: I'm a newby with Elastic. So sorry for this question. But I just can't get any further.

I want to create a rule for MS Applocker.

At Analytics - Discover with filter event.code : 8004 and event.provider = Microsoft-Windows-AppLocker I get all events related to Applocker.

But at Security - Rules I'm not able to create a rule to classify this Events.  
I do: Create new rule -\> Custom query -\> event.code : "8004" (as autocomplete suggested to me) -\> quick query preview "Last month" -\> preview results. But zero results are shown.

Where is the mistake? I can't find anything.

Patrick

---

<div class="post-metadata">

**Author:** ![Leitner](https://avatars.discourse-cdn.com/v4/letter/l/e9bcb4/32.png) [@Leitner](https://discuss.elastic.co/u/Leitner)\
**Post date:** [June 12, 2023, 1:45pm UTC](https://discuss.elastic.co/t/rule-for-applocker/334299/2 "2023-06-12T13:45:19Z")

</div>

Doesn't anyone have an idea how this could work?

Patrick

---

<div class="post-metadata">

**Author:** ![Leitner](https://avatars.discourse-cdn.com/v4/letter/l/e9bcb4/32.png) [@Leitner](https://discuss.elastic.co/u/Leitner)\
**Post date:** [June 21, 2023, 11:31am UTC](https://discuss.elastic.co/t/rule-for-applocker/334299/3 "2023-06-21T11:31:16Z")

</div>

Found out, that only the graph lies/is waste.  
Inspect the result an see the truth!

 ![Screenshot1](https://us1.discourse-cdn.com/elastic/original/3X/3/c/3ca29773fadcd804b3946066779f1cd6ca76e0ef.jpeg)  
 ![Screenshot2](https://us1.discourse-cdn.com/elastic/original/3X/3/0/3057ec266f7f174f106f9260928c0c9ff72df9d5.jpeg)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 19, 2023, 11:31am UTC](https://discuss.elastic.co/t/rule-for-applocker/334299/4 "2023-07-19T11:31:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.