# SIEM detection signals not showing up
**URL:** https://discuss.elastic.co/t/siem-detection-signals-not-showing-up/241700
**Category:** SIEM
**Created:** [July 17, 2020, 5:46pm UTC](https://discuss.elastic.co/t/siem-detection-signals-not-showing-up/241700 "2020-07-17T17:46:48Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@Darren\_G](https://discuss.elastic.co/u/Darren_G)
#### Post date: [July 17, 2020, 5:46pm UTC](https://discuss.elastic.co/t/siem-detection-signals-not-showing-up/241700/1 "2020-07-17T17:46:48Z")
I am trying to run detections in 7.8 on historical data by changing the time stamps to be recent and reindexing. The data is ECS compliant. The index is in the siem defaultIndex. I have the Additional look-back time set to make sure the events are covered. Despite this, I am not getting any signals to show up. The queries work and return data if I run them in Discover.
---
### Author:  [@yctercero](https://discuss.elastic.co/u/yctercero)
#### Post date: [July 17, 2020, 6:15pm UTC](https://discuss.elastic.co/t/siem-detection-signals-not-showing-up/241700/2 "2020-07-17T18:15:22Z")
Hi Darren\_G - welcome to the forums!
There's a few things we can try to check to see what might be happening.
1. Do you have access to Kibana logs and `kibana.yml`? If so, you can add the following line to that file in order to get more detailed logs. These verbose logs can show you more in depth information on what is happening when your rules run, generation of signals, etc.
```auto
logging.verbose: true
```
1. What does your mapping look like for `@timestamp`? Looking back at some forum posts, there can sometimes be some funkiness depending on the mapping for this field.
2. If you go to your rule details and select the `Failure History` tab, does anything show up there?
Hopefully one of these paths can help us figure out what is happening!
Best,
Yara
---
### Author:  [@Darren\_G](https://discuss.elastic.co/u/Darren_G)
#### Post date: [July 17, 2020, 6:57pm UTC](https://discuss.elastic.co/t/siem-detection-signals-not-showing-up/241700/3 "2020-07-17T18:57:48Z")
Hey Yara,
1. I do not have access to the Kibana logs / kibana.yml
2. I read a couple of the other posts too. I think the mapping for @timestam looks ok:
@timestamp" : {
"type" : "date"
},
3. The rules rules did not fail at all.
---
### Author:  [@yctercero](https://discuss.elastic.co/u/yctercero)
#### Post date: [July 17, 2020, 8:33pm UTC](https://discuss.elastic.co/t/siem-detection-signals-not-showing-up/241700/4 "2020-07-17T20:33:42Z")
Yea, that looks ok. Well it's a good sign if you're not seeing any errors in that `Failure History` tab! What status is shown in the rule details page for the rule in question?
If the rule shows `succeeded` and no errors are showing up as you mentioned, then the rule itself is likely running fine, but may instead be an issue with the index pattern.
Are you a part of our [Slack community workspace](https://www.elastic.co/blog/join-our-elastic-stack-workspace-on-slack)? If you don't mind, feel free to private message me your index patterns to see if we can spot anything.
Best,
Yara
---
### Author:  [@Frank\_Hassanabad](https://discuss.elastic.co/u/Frank_Hassanabad)
#### Post date: [July 20, 2020, 2:52pm UTC](https://discuss.elastic.co/t/siem-detection-signals-not-showing-up/241700/5 "2020-07-20T14:52:36Z")
@Darren_G, Do the same events show up using timeline within the same time period and query?
---
### Author:  [@Darren\_G](https://discuss.elastic.co/u/Darren_G)
#### Post date: [July 20, 2020, 4:01pm UTC](https://discuss.elastic.co/t/siem-detection-signals-not-showing-up/241700/6 "2020-07-20T16:01:05Z")
The query is saying that it succeeded. I don't know how the detection query is running on the first attempt and how it uses the look-back time, so I might need a way to see the logs. I'll look into it a little more and will DM you in slack.
---
### Author:  [@Darren\_G](https://discuss.elastic.co/u/Darren_G)
#### Post date: [July 20, 2020, 4:02pm UTC](https://discuss.elastic.co/t/siem-detection-signals-not-showing-up/241700/7 "2020-07-20T16:02:00Z")
Yes, the event show up when I run the query in the timeline
---
### Author:  [@Darren\_G](https://discuss.elastic.co/u/Darren_G)
#### Post date: [July 30, 2020, 4:17pm UTC](https://discuss.elastic.co/t/siem-detection-signals-not-showing-up/241700/8 "2020-07-30T16:17:58Z")
I ended up changing the @timestamp with the date filter plugin to make it look like the data is coming in live. The test signals I wrote ended up showing up.
---
### Author:  [@Frank\_Hassanabad](https://discuss.elastic.co/u/Frank_Hassanabad)
#### Post date: [August 3, 2020, 4:00pm UTC](https://discuss.elastic.co/t/siem-detection-signals-not-showing-up/241700/9 "2020-08-03T16:00:02Z")
Great!
In the next upcoming release we have added a timestamp override btw so you can choose a different timestamp to represent the ingest time rather than always having to change the @timestamp.
Details are here:
>
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 31, 2020, 4:00pm UTC](https://discuss.elastic.co/t/siem-detection-signals-not-showing-up/241700/10 "2020-08-31T16:00:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.