# SIEM Event Correlation rule returns no data

**URL:** <https://discuss.elastic.co/t/siem-event-correlation-rule-returns-no-data/291197>\
**Category:** SIEM\
**Created:** [December 8, 2021, 9:27am UTC](https://discuss.elastic.co/t/siem-event-correlation-rule-returns-no-data/291197 "2021-12-08T09:27:11Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![pruttle](https://avatars.discourse-cdn.com/v4/letter/p/7ea924/32.png) [@pruttle](https://discuss.elastic.co/u/pruttle)\
**Post date:** [December 8, 2021, 9:27am UTC](https://discuss.elastic.co/t/siem-event-correlation-rule-returns-no-data/291197/1 "2021-12-08T09:27:11Z")

</div>

Kibana version 7.14.1  
I am creating an Event Correlation rule in SIEM and the preview does not return any results. If I do the same query in Dev Tools it works.  
I see that the preview runs some kind of java script but the dev tools appear to do a standard web request.  
If I copy the request from Event Correlation which looks like this:

```auto
{ "filter: 
     { "range": { "@timestamp" 
            { "gte" : "2021-12-07T09:03:22.318Z", 
               "lte" : "2021-12-08T09:03:22.318Z",
                "format" : "strict_date_optional_time" }
    }}}
,
"query": "process where xxxxx == xxxx", "size": 100 }

```

If I paste into Dev Tools and GET on a wild card or specific index it works.  
Is it possible there is a permissions issue? I am using the same account for the preview and the query.  
Thanks

---

<div class="post-metadata">

**Author:** ![Frank\_Hassanabad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frank_hassanabad/32/49255_2.png) [@Frank\_Hassanabad](https://discuss.elastic.co/u/Frank_Hassanabad)\
**Post date:** [December 9, 2021, 9:10pm UTC](https://discuss.elastic.co/t/siem-event-correlation-rule-returns-no-data/291197/2 "2021-12-09T21:10:33Z")

</div>

I wonder if you're encountering this issue:

> <https://github.com/elastic/kibana/issues/119098>
>
> \## Summary
> 
> I have a test index for source events with custom non-ECS fields. …If I create a rule that targets this index, I can't see any results in the Rule Preview, but the rule is able to find the events and generate alerts if you save and run it.
> 
> \## Repro steps
> 
> Create a custom index for source events and write a test object with a timestamp as of today:
> 
> \`\`\`
> PUT /sdh-247
> {
> "mappings": {
> "dynamic": "true",
> "properties": {
> "@timestamp": { "type": "date" },
> "deviceCustomDateLabel": { "type": "keyword" },
> "deviceCustomDate\_Date": { "type": "date" },
> "deviceCustomDate\_Long": { "type": "long" },
> "deviceCustomDate\_DateNanos": { "type": "date\_nanos" }
> }
> },
> "settings": {
> "index": {
> "number\_of\_shards": 1
> }
> }
> }
> 
> PUT /sdh-247/\_doc/1
> {
> "@timestamp": "2021-11-18T12:10:30Z",
> "deviceCustomDateLabel": "TRENUTAN\_DATUM\_UO",
> "deviceCustomDate\_Date": "2021-11-18T12:10:30Z",
> "deviceCustomDate\_Long": 1074640200000,
> "deviceCustomDate\_DateNanos": 1074640200000
> }
> \`\`\`
> 
> Create a Custom query rule that should generate an alert based off of it:
> 
> !\[\](https://puu.sh/Iq2on/fc109c736a.png)
> 
> Observe no results in the Rule Preview:
> 
> !\[\](https://puu.sh/Iq2p3/3c9c0fe685.png)
> 
> Set a sufficient look-back time so the rule could find the source event (e.g. 48 hours). Save and run this rule, and it should find the event and generate an alert from it:
> 
> !\[\](https://puu.sh/Iq2qR/1205892ea9.png)
> 
> \## Environment
> 
> Local dev environment
> Branch: \`main\`
> Kibana config:
> 
> \`\`\`yml
> elasticsearch:
> username: 'kibana\_system'
> password: 'changeme'
> hosts: 'http://localhost:9200'
> 
> xpack.ruleRegistry.write.enabled: true
> xpack.ruleRegistry.unsafe.indexUpgrade.enabled: true
> xpack.ruleRegistry.unsafe.legacyMultiTenancy.enabled: true
> xpack.securitySolution.enableExperimental: \['ruleRegistryEnabled'\]
> \`\`\`

---

<div class="post-metadata">

**Author:** ![pruttle](https://avatars.discourse-cdn.com/v4/letter/p/7ea924/32.png) [@pruttle](https://discuss.elastic.co/u/pruttle)\
**Post date:** [December 13, 2021, 3:20pm UTC](https://discuss.elastic.co/t/siem-event-correlation-rule-returns-no-data/291197/3 "2021-12-13T15:20:46Z")

</div>

Thanks for the reply. I don't think this is this issue but presumably an update would fix it? Cheers

---

<div class="post-metadata">

**Author:** ![pruttle](https://avatars.discourse-cdn.com/v4/letter/p/7ea924/32.png) [@pruttle](https://discuss.elastic.co/u/pruttle)\
**Post date:** [December 17, 2021, 9:06am UTC](https://discuss.elastic.co/t/siem-event-correlation-rule-returns-no-data/291197/4 "2021-12-17T09:06:06Z")

</div>

When I look at a document where the preview works, the @timestamp value is in the \_source section of the JSON.  
A document where the preview does not work has the @timestamp in the \_fields section.

Presumably the SIEM Event Correlation EQL query runs against the \_source only?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 14, 2022, 9:06am UTC](https://discuss.elastic.co/t/siem-event-correlation-rule-returns-no-data/291197/5 "2022-01-14T09:06:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.