# SIEM Signals Index and Component Templates

**URL:** https://discuss.elastic.co/t/siem-signals-index-and-component-templates/279313
**Category:** Kibana
**Created:** [July 21, 2021, 8:38pm UTC](https://discuss.elastic.co/t/siem-signals-index-and-component-templates/279313 "2021-07-21T20:38:59Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![MakoWish](https://avatars.discourse-cdn.com/v4/letter/m/e56c9b/32.png) [@MakoWish](https://discuss.elastic.co/u/MakoWish)
#### Post date: [July 21, 2021, 8:38pm UTC](https://discuss.elastic.co/t/siem-signals-index-and-component-templates/279313/1 "2021-07-21T20:38:59Z")

</div>

I have started translating and migrating all my legacy Index Templates over to the new Component Templates, but when I got to the `.siem-signals-<space>` template, I am now getting an error:

```auto
An error occurred during rule execution: message: "EQL based rules require an update to version 2 of the detection alerts index mapping" name: "Credential Acquisition via Registry Hive Dumping" id: "7e2cc050-cd4d-11eb-ab0a-51ff65f25624" rule id: "b4629ee0-92ce-440b-9165-c2b34556c6e7" signals index: ".siem-signals-default"

```

Is the Security app not yet compatible with Component Templates?

---

<div class="post-metadata">

### Author: ![MakoWish](https://avatars.discourse-cdn.com/v4/letter/m/e56c9b/32.png) [@MakoWish](https://discuss.elastic.co/u/MakoWish)
#### Post date: [July 21, 2021, 10:35pm UTC](https://discuss.elastic.co/t/siem-signals-index-and-component-templates/279313/2 "2021-07-21T22:35:55Z")

</div>

Please disregard. I was able to get a Component Template to work. I went through and copied all settings (other than mappings), and it now works. I suspect perhaps the `"version" : 35` setting? I originally had `"version" : 1`.

Here is my working Component Template for SIEM Signals:

```auto
PUT _index_template/.siem-signals-default
{
  "index_patterns" : [
    ".siem-signals-default-*"
  ],
  "template" : {
    "settings" : {
      "index" : {
        "lifecycle" : {
          "name" : ".siem-signals-default",
          "rollover_alias" : ".siem-signals-default"
        },
        "mapping" : {
          "total_fields" : {
            "limit" : "10000"
          }
        }
      }
    },
    "mappings" : {
      "_meta": {
        "version": 35
      },
      "dynamic": false,
      "properties" : {
        "_score" : {
          "type" : "long"
        }
      }
    },
    "aliases" : {}
  },
  "composed_of" : [
    "@timestamp",
    "@version",
    "document_id",
    "agent",
    "as",
    "client",
    "cloud",
    "code_signature",
    "container",
    "destination",
    "dll",
    "dns",
    "ecs",
    "error",
    "event",
    "file",
    "geo",
    "group",
    "hash",
    "host",
    "http",
    "interface",
    "labels",
    "log",
    "logstash",
    "message",
    "network",
    "observer",
    "organization",
    "os",
    "package",
    "pe",
    "process",
    "registry",
    "related",
    "rule",
    "server",
    "service",
    "signal",
    "source",
    "span",
    "tags",
    "threat",
    "tls",
    "trace",
    "transaction",
    "url",
    "user",
    "user_agent",
    "vlan",
    "vulnerability",
    "windows",
    "winlog"
  ],
  "version" : 35,
  "_meta" : {
    "description" : "SIEM Signals Component-Based Template"
  }
}

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 18, 2021, 10:35pm UTC](https://discuss.elastic.co/t/siem-signals-index-and-component-templates/279313/3 "2021-08-18T22:35:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.