# Threat detection rules VS beats

**URL:** <https://discuss.elastic.co/t/threat-detection-rules-vs-beats/275311>\
**Category:** SIEM\
**Created:** [June 8, 2021, 2:41pm UTC](https://discuss.elastic.co/t/threat-detection-rules-vs-beats/275311 "2021-06-08T14:41:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![farciarz121](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@farciarz121](https://discuss.elastic.co/u/farciarz121)\
**Post date:** [June 8, 2021, 2:41pm UTC](https://discuss.elastic.co/t/threat-detection-rules-vs-beats/275311/1 "2021-06-08T14:41:54Z")

</div>

Can someone tell me if default detection rules are capable of triggering alerts base on logs from events (not from fleet). I.e. new user creation. I can not make it work. Also, how do I define my own custom policies that will trigger alerts base on logs from beats (packet beat, winlog beat etc.).

---

<div class="post-metadata">

**Author:** ![pcosic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pcosic/32/90827_2.png) [@pcosic](https://discuss.elastic.co/u/pcosic)\
**Post date:** [June 25, 2021, 10:26am UTC](https://discuss.elastic.co/t/threat-detection-rules-vs-beats/275311/2 "2021-06-25T10:26:30Z")

</div>

It is of course possible.  
You should better describe your attempts that you have already made and what does not work.  
On which data do you want to make alerts?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 23, 2021, 10:27am UTC](https://discuss.elastic.co/t/threat-detection-rules-vs-beats/275311/3 "2021-07-23T10:27:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.