# Signal SIEM Detections using log files **URL:** \ **Category:** SIEM\ **Created:** [April 6, 2020, 9:37am UTC](https://discuss.elastic.co/t/signal-siem-detections-using-log-files/226667 "2020-04-06T09:37:41Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![david-vazquez](https://avatars.discourse-cdn.com/v4/letter/d/ac8455/32.png) [@david-vazquez](https://discuss.elastic.co/u/david-vazquez)\ **Post date:** [April 6, 2020, 9:37am UTC](https://discuss.elastic.co/t/signal-siem-detections-using-log-files/226667/1 "2020-04-06T09:37:41Z")
Hello, I ingested some data from firewall devices of which I would like to create rules in the Detections part of the Elastic SIEM. I created a rule to detect Malware using a field of the log file which has that information. The problem is I only have logs from a brief secuence of time (only a month of logs). I´m configuring in the SIEM calendar the value "Last 90 days", but no signals are shown from that period of time (logs are from March). If I use the KQL query into Discover of Kibana, it works properly, so I think rule should be working. My doubt is: why can´t I see the signal against this "old" file? Should be new data introduced again in Elasticsearch after rule is created? can´t I see signals using this period of time? Thank you all. Greetings ---
**Author:** ![Frank\_Hassanabad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frank_hassanabad/32/49255_2.png) [@Frank\_Hassanabad](https://discuss.elastic.co/u/Frank_Hassanabad)\ **Post date:** [April 6, 2020, 2:29pm UTC](https://discuss.elastic.co/t/signal-siem-detections-using-log-files/226667/2 "2020-04-06T14:29:31Z")
The detection engine by default when you create a rule goes back by 5 minutes every 5 minutes looking for signals. It's more real time-ish than it is historic. ![Screen Shot 2020-04-06 at 8.25.53 AM](https://us1.discourse-cdn.com/elastic/original/3X/6/8/68e49af4762bf26f962da8bb7f2e57c0e0d2836f.png) You could potentially either re-index your index to make it look like it is from recent times or configure a rule to run really really far backwards and then turn it on once and run it and then turn it off as a workaround if you want to. ---
**Author:** ![david-vazquez](https://avatars.discourse-cdn.com/v4/letter/d/ac8455/32.png) [@david-vazquez](https://discuss.elastic.co/u/david-vazquez)\ **Post date:** [April 6, 2020, 2:44pm UTC](https://discuss.elastic.co/t/signal-siem-detections-using-log-files/226667/3 "2020-04-06T14:44:27Z")
Thank you very much for the information. Regards. ---
**Author:** ![david-vazquez](https://avatars.discourse-cdn.com/v4/letter/d/ac8455/32.png) [@david-vazquez](https://discuss.elastic.co/u/david-vazquez)\ **Post date:** [April 24, 2020, 6:58pm UTC](https://discuss.elastic.co/t/signal-siem-detections-using-log-files/226667/4 "2020-04-24T18:58:20Z")
By the way, i have a doubt. I created a rule to detect if a windows event ID appear, so it means something happened. I would like to limit the alert I see in Detections side of the SIEM just for cases where the event appears more like X times. I mean, if for example I detect an event which means someone is trying to log into my host, I would like to see the Detections just if someone tried it during 5 times. So, if event appears 5 times, the "alert" is shown. Is it possible? Thanks ---
**Author:** ![Frank\_Hassanabad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frank_hassanabad/32/49255_2.png) [@Frank\_Hassanabad](https://discuss.elastic.co/u/Frank_Hassanabad)\ **Post date:** [April 25, 2020, 12:26am UTC](https://discuss.elastic.co/t/signal-siem-detections-using-log-files/226667/5 "2020-04-25T00:26:44Z")
It cannot do thresholds or counts like that just yet over a period of time. We are hoping soon though. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 23, 2020, 12:26am UTC](https://discuss.elastic.co/t/signal-siem-detections-using-log-files/226667/6 "2020-05-23T00:26:44Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.