# Rules not triggering alerts **URL:** \ **Category:** Elastic Security\ **Tags:** detection-rules\ **Created:** [August 31, 2021, 9:43am UTC](https://discuss.elastic.co/t/rules-not-triggering-alerts/282899 "2021-08-31T09:43:31Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![john12](https://avatars.discourse-cdn.com/v4/letter/j/f9ae1b/32.png) [@john12](https://discuss.elastic.co/u/john12)\ **Post date:** [August 31, 2021, 9:43am UTC](https://discuss.elastic.co/t/rules-not-triggering-alerts/282899/1 "2021-08-31T09:43:31Z")
Hello, I am creating so simple custom rules, which supposed to trigger alerts - my ELK version is 7.14 - i have tested the query in the discover section and it retrieve a result, so the rule should trigger and alert - is there rule detection log or something? how to troubleshoot this issue? ---
**Author:** ![Jonathan\_Buttner](https://avatars.discourse-cdn.com/v4/letter/j/9d8465/32.png) [@Jonathan\_Buttner](https://discuss.elastic.co/u/Jonathan_Buttner)\ **Post date:** [August 31, 2021, 2:46pm UTC](https://discuss.elastic.co/t/rules-not-triggering-alerts/282899/2 "2021-08-31T14:46:55Z")
Hey @john12 , Thanks for your question. Here are a couple things that come to mind for troubleshooting a detection rule. - Checkout the troubleshooting docs: [Monitor and troubleshoot rule executions | Elastic Security Solution [7.14] | Elastic](https://www.elastic.co/guide/en/security/current/alerts-ui-monitor.html) - Try leveraging the preview to see what alerts would be triggered when creating your rule > **Example preview** > > ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/f/6ff78061e88a532ac5f0a2a4425eb8a42c4d0480.png) - Check the Rule Monitoring tab to see if there are warnings or errors for your rule > **Rule Monitoring** > > ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/a/ba4c9c459b59f8d6f1ea73530e3fb343d033ef06.png) - There are detection logs, they are written to the Kibana logs ---
**Author:** ![trickster0](https://avatars.discourse-cdn.com/v4/letter/t/8dc957/32.png) [@trickster0](https://discuss.elastic.co/u/trickster0)\ **Post date:** [September 5, 2021, 10:44am UTC](https://discuss.elastic.co/t/rules-not-triggering-alerts/282899/3 "2021-09-05T10:44:35Z")
Hello I have been having the same issue with 7.14.1 while in 7.13, same rules with same logs work just fine and the alert is triggered. It is no crazy query just event.code:"1116" which is for defender that a malware is found. I can verify that i see it in my winlogbeat logs but the alert even though in monitoring says it is run, there are no alerts triggered. This is a custom rule, the default ones work just fine. ---
**Author:** ![john12](https://avatars.discourse-cdn.com/v4/letter/j/f9ae1b/32.png) [@john12](https://discuss.elastic.co/u/john12)\ **Post date:** [September 8, 2021, 12:06pm UTC](https://discuss.elastic.co/t/rules-not-triggering-alerts/282899/4 "2021-09-08T12:06:21Z")
Thats right, i discovered thats its a bug not solved yet ---
**Author:** ![frank\_rib](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frank_rib/32/104372_2.png) [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\ **Post date:** [September 11, 2021, 9:12pm UTC](https://discuss.elastic.co/t/rules-not-triggering-alerts/282899/5 "2021-09-11T21:12:37Z")
Hello, Did you check if there is any delay in receiving logs in ELK. If at the level of the Schedule rule you have Run every 5 and in additional look-back time = 1 then the rules will be applied only to the events received during the last 6 min Best regards, ---
**Author:** ![trickster0](https://avatars.discourse-cdn.com/v4/letter/t/8dc957/32.png) [@trickster0](https://discuss.elastic.co/u/trickster0)\ **Post date:** [September 21, 2021, 7:40am UTC](https://discuss.elastic.co/t/rules-not-triggering-alerts/282899/6 "2021-09-21T07:40:47Z")
Hello frank\_rib, yes i did the test at the same time while the rule was checking for even 10 minutes before. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 19, 2021, 7:41am UTC](https://discuss.elastic.co/t/rules-not-triggering-alerts/282899/7 "2021-10-19T07:41:10Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.