# Rule hits visible in preview, but no alerts triggered **URL:** \ **Category:** Elastic Security\ **Created:** [October 22, 2021, 7:24pm UTC](https://discuss.elastic.co/t/rule-hits-visible-in-preview-but-no-alerts-triggered/287457 "2021-10-22T19:24:39Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![mcreedjr](https://avatars.discourse-cdn.com/v4/letter/m/e8c25b/32.png) [@mcreedjr](https://discuss.elastic.co/u/mcreedjr)\ **Post date:** [October 22, 2021, 7:24pm UTC](https://discuss.elastic.co/t/rule-hits-visible-in-preview-but-no-alerts-triggered/287457/1 "2021-10-22T19:24:39Z")
I've imported the default Elastic rules, and duplicated the 'whoami' rule. When I preview the rule, it shows hits, but there are no alerts raised. I feel that I'm missing something super obvious, but I would expect to see items listed under open Alerts if I'm getting matches when previewing the rule. ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/8/78ad9f628b03cd999dd4487cd6cb2585ae29e6ed.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/2/92ed6d07b82f6973b680f4ab1ef8cca432d465d0.png) ---
**Author:** ![mcreedjr](https://avatars.discourse-cdn.com/v4/letter/m/e8c25b/32.png) [@mcreedjr](https://discuss.elastic.co/u/mcreedjr)\ **Post date:** [October 23, 2021, 6:52am UTC](https://discuss.elastic.co/t/rule-hits-visible-in-preview-but-no-alerts-triggered/287457/2 "2021-10-23T06:52:07Z")
Sounds like maybe this is the same problem? > [@Rules not triggering alerts](https://discuss.elastic.co/t/rules-not-triggering-alerts/282899): > > Hello, I am creating so simple custom rules, which supposed to trigger alerts my ELK version is 7.14 i have tested the query in the discover section and it retrieve a result, so the rule should trigger and alert is there rule detection log or something? how to troubleshoot this issue? ---
**Author:** ![mcreedjr](https://avatars.discourse-cdn.com/v4/letter/m/e8c25b/32.png) [@mcreedjr](https://discuss.elastic.co/u/mcreedjr)\ **Post date:** [October 24, 2021, 1:39am UTC](https://discuss.elastic.co/t/rule-hits-visible-in-preview-but-no-alerts-triggered/287457/3 "2021-10-24T01:39:54Z")
I've researched some more, and it appears that custom queries using KQL are working properly, but it appears alerts using EQL (maybe others) are not firing for some reason. Any ideas? ---
**Author:** ![n2x4](https://avatars.discourse-cdn.com/v4/letter/n/3e96dc/32.png) [@n2x4](https://discuss.elastic.co/u/n2x4)\ **Post date:** [October 27, 2021, 3:27am UTC](https://discuss.elastic.co/t/rule-hits-visible-in-preview-but-no-alerts-triggered/287457/4 "2021-10-27T03:27:03Z")
While this doesn't give you an answer, I can confirm that these rules are working in my 7.14 environment. I used the prebuilt whoami rule and an alert was generated. I also duplicated the rule, verified results were previewing, and saved the rule and generated a detection event which resulted in an alert. The only thing I could think of is maybe an issue with your rule lookback time, but I'm sure you have tried adjusting that already. ---
**Author:** ![PublicName](https://avatars.discourse-cdn.com/v4/letter/p/74df32/32.png) [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Post date:** [October 27, 2021, 4:10pm UTC](https://discuss.elastic.co/t/rule-hits-visible-in-preview-but-no-alerts-triggered/287457/5 "2021-10-27T16:10:02Z")
Following as this is a problem in 7.15 as well. Custom rules do not trigger correctly. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 27, 2021, 9:59am UTC](https://discuss.elastic.co/t/rule-hits-visible-in-preview-but-no-alerts-triggered/287457/7 "2021-11-27T09:59:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.