# Threshold detection rule - limitation of group by fields

**URL:** <https://discuss.elastic.co/t/threshold-detection-rule-limitation-of-group-by-fields/338383>\
**Category:** SIEM\
**Created:** [July 14, 2023, 8:00am UTC](https://discuss.elastic.co/t/threshold-detection-rule-limitation-of-group-by-fields/338383 "2023-07-14T08:00:41Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Poukim0m](https://avatars.discourse-cdn.com/v4/letter/p/898d66/32.png) [@Poukim0m](https://discuss.elastic.co/u/Poukim0m)\
**Post date:** [July 14, 2023, 8:00am UTC](https://discuss.elastic.co/t/threshold-detection-rule-limitation-of-group-by-fields/338383/1 "2023-07-14T08:00:42Z")

</div>

Hello,

I want to implement a threshold detection rule that aggregates more than 3 fields in the "Group by" section of rule definition. But there seems to be a limitation of 3 fields as i get an error message "Number of fields must be 3 or less." Is there any workaround? E.g I want to detect multiple failed logins from same source same user same destination and customername.

---

<div class="post-metadata">

**Author:** ![Ruben\_Groenewoud](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruben_groenewoud/32/123982_2.png) [@Ruben\_Groenewoud](https://discuss.elastic.co/u/Ruben_Groenewoud)\
**Post date:** [July 27, 2023, 1:20pm UTC](https://discuss.elastic.co/t/threshold-detection-rule-limitation-of-group-by-fields/338383/2 "2023-07-27T13:20:20Z")

</div>

Hi Poukim0m. Thanks for reaching out.

I think that what you are looking for is an [EQL sequence](https://www.elastic.co/guide/en/elasticsearch/reference/current/eql-syntax.html#eql-sequences), rather than a threshold query. By using a sequence, you can use the `by` join keyword to look for matching documents. An example would look something like the following:

```auto
sequence by source.ip, user.name, destination.ip, customer.name with maxspan=5s 
[process where ...] with runs = 10

```

Thanks,

Ruben

---

<div class="post-metadata">

**Author:** ![Poukim0m](https://avatars.discourse-cdn.com/v4/letter/p/898d66/32.png) [@Poukim0m](https://discuss.elastic.co/u/Poukim0m)\
**Post date:** [August 16, 2023, 7:42am UTC](https://discuss.elastic.co/t/threshold-detection-rule-limitation-of-group-by-fields/338383/3 "2023-08-16T07:42:36Z")

</div>

Hello @Ruben_Groenewoud.  
Thank you for your answer!  
I suppose that this works if customer.name is present in all indexes that the rule applies on. Otherwise it is applicable only when the customer name value is present. Correct?  
Also, i tested it and found that same logic in threshold rule provides one single alert and in EQL correlation rule 19 alerts. runs = 10 is applied on the rule

---

<div class="post-metadata">

**Author:** ![Ruben\_Groenewoud](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruben_groenewoud/32/123982_2.png) [@Ruben\_Groenewoud](https://discuss.elastic.co/u/Ruben_Groenewoud)\
**Post date:** [August 22, 2023, 1:51pm UTC](https://discuss.elastic.co/t/threshold-detection-rule-limitation-of-group-by-fields/338383/4 "2023-08-22T13:51:54Z")

</div>

Hi @Poukim0m, regarding your first question - that is correct. By default, when sequencing by a specific field, the EQL rule will indeed require that field to be present in the index/document. However, it is possible to specify [optional fields](https://www.elastic.co/guide/en/elasticsearch/reference/current/eql-syntax.html#eql-syntax-optional-fields) by using the `?` symbol. So in your usecase, it would be possible to write a sequence similar to this, which will also run if the customer.name field is not present:

```auto
sequence by source.ip, user.name, destination.ip, ?customer.name with maxspan=5s 
[process where ...] with runs = 10

```

Be aware of potential performance drops when using this feature.

With regards to your last comment, yes that makes sense. When for example creating sequence with runs=10, it will generate multiple signals. You can choose to turn the rule into a [building block rule](https://www.elastic.co/guide/en/security/current/building-block-rule.html) so it doesn't flood your detection rules dashboard. EQL sequence rule alerts do generate much more useful alerts than threshold rules, as they contain more data.

Ruben

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 19, 2023, 1:52pm UTC](https://discuss.elastic.co/t/threshold-detection-rule-limitation-of-group-by-fields/338383/5 "2023-09-19T13:52:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.