The issue in a detection rule

Elastic Security SIEM
1

Hi there,

We would like your support, we face an issue if we create a detection rule where no result appears but results appears when we do the same search in the discover side , please assist me the solving an issue with my elk version: 7.17.8

2

Hi saud,

Could you show us your detection rule definition?
Preferably the export ndjson if possible.

This way we can look for some syntax stuff and "hidden" fields :wink:

3

I sure from syntax

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.