# Security Solution Plugins & @timestamp

**URL:** https://discuss.elastic.co/t/security-solution-plugins-timestamp/257217
**Category:** SIEM
**Created:** [December 1, 2020, 2:35pm UTC](https://discuss.elastic.co/t/security-solution-plugins-timestamp/257217 "2020-12-01T14:35:49Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![teej](https://avatars.discourse-cdn.com/v4/letter/t/b5a626/32.png) [@teej](https://discuss.elastic.co/u/teej)
#### Post date: [December 1, 2020, 2:35pm UTC](https://discuss.elastic.co/t/security-solution-plugins-timestamp/257217/1 "2020-12-01T14:35:50Z")

</div>

Good Day,  
Just updated to 7.10 and while examining the kibana logs I find:

{"type":"log","@timestamp":"2020-11-25T20:37:07Z","tags":["error","plugins","securitySolution","plugins","securitySolution"],"pid":22460,"message":"Bulk Indexing of signals failed: reason: "No mapping found for [@timestamp] in order to sort on" type: "query\_shard\_exception" name: "Virtual Machine Fingerprinting" id: "cd23d3ba-a8a3-4b1d-9fd0-8946e06b9690" rule id: "5b03c9fb-9945-4d2f-9568-fd690fee3fba" signals index: ".siem-signals-default""}

It appears to being caused by a plugin? Is that a SIEM thing perhaps?

---

<div class="post-metadata">

### Author: ![Frank\_Hassanabad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frank_hassanabad/32/49255_2.png) [@Frank\_Hassanabad](https://discuss.elastic.co/u/Frank_Hassanabad)
#### Post date: [December 3, 2020, 1:31am UTC](https://discuss.elastic.co/t/security-solution-plugins-timestamp/257217/2 "2020-12-03T01:31:36Z")

</div>

That is from the SIEM solutions plugin detection engine. You have a rule enabled called, "Virtual Machine Fingerprinting" which is using a source index to search for detections. That source index does not have a `@timestamp` to search against and therefore is giving you errors.

You can go to the detections page and disable the rule if you aren't using it. If you are using it and want it to run correctly you have to ensure that the source index it is looking for detections against has a `@timestamp` for it to operate correctly.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 31, 2020, 1:31am UTC](https://discuss.elastic.co/t/security-solution-plugins-timestamp/257217/3 "2020-12-31T01:31:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
