# \[ Threshold Rule \]: Unexpected result

**URL:** <https://discuss.elastic.co/t/threshold-rule-unexpected-result/260956>\
**Category:** SIEM\
**Tags:** elastic-stack-security, elastic-stack-alerting\
**Created:** [January 13, 2021, 8:59am UTC](https://discuss.elastic.co/t/threshold-rule-unexpected-result/260956 "2021-01-13T08:59:58Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheHunter1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thehunter1/32/80190_2.png) [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\
**Post date:** [January 13, 2021, 8:59am UTC](https://discuss.elastic.co/t/threshold-rule-unexpected-result/260956/1 "2021-01-13T08:59:58Z")

</div>

Hello,

I would like to create a Threshold rule to detect files downloaded more than 1 Go.  
So in my firewall logs I have the field `rcvd` where I can find this value, and I to test that, I tested to download a file with 1.7 Go, and I could see that in the discover app as we can see in the picture below:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/2/22b4c6da74fb27b1534e046d7d927e1a720518d0.png)

But when I try to create an threshold rule to detect that, and I run `preview results`, it doesn't detect it.

I have configured it like that:

**index patterns :** firewall-\*  
**Custom query:** rcvd: \*  
**Field :** rcvd  
**Threshhold :** it detect something when I use 1000 but more than 4000 it not detect anaything

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/b/eb103d8c127c44f46297a16e7c31f7899a9a8660.png)  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/b/6b7603c0526dc5a7e9f454041ebc2819eea58082.png)

Could you tell me please why in the discover section I am seeing the `rcvd` which is equal to `1844015137` but the `threshold` job couldn't see it ?

Thanks for your help

---

<div class="post-metadata">

**Author:** ![TheHunter1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thehunter1/32/80190_2.png) [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\
**Post date:** [January 13, 2021, 10:13am UTC](https://discuss.elastic.co/t/threshold-rule-unexpected-result/260956/2 "2021-01-13T10:13:00Z")

</div>

I tried to create the same rule passing by : `Management → Stack Management → watcher → Create → Create threshold alert.`

and now it detected it and it's workign fine as you can see here:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/3/43021822db936057fc59d24726a682814f4684ab.png)

(I used here last 2 hours, cause it passed 1 hour since I tested it, so it's not for that, that it didn't appear in the first rule)

Could you tell me please, why the first threshold alert didn't work? is it a bug or it's just me who didn't know how to configure it !

---

<div class="post-metadata">

**Author:** ![yctercero](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yctercero/32/68560_2.png) [@yctercero](https://discuss.elastic.co/u/yctercero)\
**Post date:** [January 13, 2021, 5:10pm UTC](https://discuss.elastic.co/t/threshold-rule-unexpected-result/260956/3 "2021-01-13T17:10:33Z")

</div>

Hi there @TheHunter1 !

To make sure I understand, your finding is:

- Threshold rule worked as expected when the threshold value was under 4000 for field `rcvd`
- Creating an alert via watcher you were able to get it to fire on the expected value of `rcvd` being \>= 4000

Does that sound right? My question here would be, are you wanting to find records where the **value** of `rcvd` is greater than 4000 or are you wanting to be alerted when there are \>= 4000 records that match your query within your rule timeframe?

For example, per the [documentation](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-threshold-rule), for threshold rules if the `Field` is `source.ip` and its `Threshold` is `10` , an alert is generated for every source IP address that appears in at least 10 of the rule’s search results.

Would you mind sharing the query used for discover and the query used for the preview functionality in the rule creation process? You can find the inspect button in the top right portion of the preview.

 ![Screen Shot 2021-01-13 at 11.58.06 AM](https://us1.discourse-cdn.com/elastic/original/3X/8/9/89e9dda91ad48d6fe751567d505e888dc9452b1d.png)

You can compare the query being used in the rule preview to the query you used in discover to ensure that they are asking the same question of your data.

---

<div class="post-metadata">

**Author:** ![TheHunter1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thehunter1/32/80190_2.png) [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\
**Post date:** [January 14, 2021, 8:13am UTC](https://discuss.elastic.co/t/threshold-rule-unexpected-result/260956/4 "2021-01-14T08:13:38Z")

</div>

Thanks for your answer @yctercero,

In fact I want to be alerted when there is a log with `rcvd` value greater than `268435456`, which means that a user has downloaded a file with more than 2 Go.

so for example I run the below query in the `Discover` app: `rcvd >= 268435456` for the `last 1 day` logs, and I got this result:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/c/5c6dd24391a9d6c005689ea342060666d03834ab.png)

and here is what I configured in the alerting app:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/b/4bb86d798b3d6578c02c68a79856a00d6b8f95ad.png)

And when I clicked on preview data, I didn't go any `hits`

and here is the query:

```auto
{
  "aggregations": {
    "eventActionGroup": {
      "terms": {
        "field": "rcvd",
        "order": {
          "_count": "desc"
        },
        "size": 10,
        "min_doc_count": "268435456"
      },
      "aggs": {
        "events": {
          "date_histogram": {
            "field": "@timestamp",
            "fixed_interval": "2699999ms",
            "min_doc_count": 0,
            "extended_bounds": {
              "min": 1610525262930,
              "max": 1610611662929
            }
          }
        }
      }
    }
  },
  "query": {
    "bool": {
      "filter": [
        {
          "bool": {
            "must": [],
            "filter": [
              {
                "bool": {
                  "should": [
                    {
                      "exists": {
                        "field": "rcvd"
                      }
                    }
                  ],
                  "minimum_should_match": 1
                }
              }
            ],
            "should": [],
            "must_not": []
          }
        },
        {
          "range": {
            "@timestamp": {
              "gte": "2021-01-13T08:07:42.930Z",
              "lte": "2021-01-14T08:07:42.929Z",
              "format": "strict_date_optional_time"
            }
          }
        }
      ]
    }
  },
  "size": 0,
  "track_total_hits": true
}

```

For me I thought that the `Threshold` Alerting, will send an alert everytime the value of `rcvd` be greater than `268435456`, but as I see in the query generated automatically, if I understand well, the alert will be generated if `"min_doc_count": "268435456"` !!

---

<div class="post-metadata">

**Author:** ![yctercero](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yctercero/32/68560_2.png) [@yctercero](https://discuss.elastic.co/u/yctercero)\
**Post date:** [January 14, 2021, 12:32pm UTC](https://discuss.elastic.co/t/threshold-rule-unexpected-result/260956/5 "2021-01-14T12:32:34Z")

</div>

That's correct! So as you can see in the query you shared from the rule creation preview, threshold is focused on doc count. The idea here being, for example, if I as a user wanted to ask "don't alert me every single time some value appears, just alert me when it occurs more than 'x' times in my rule timeframe". In other words, it is more about aggregations rather than a particular value threshold.

That said, you can accomplish the same as you did in Discover using the custom rule query.

 ![Screen Shot 2021-01-14 at 7.30.46 AM](https://us1.discourse-cdn.com/elastic/original/3X/2/b/2b7feb5f33030452b5bbc9414e8491b81aec7bca.png)

---

<div class="post-metadata">

**Author:** ![TheHunter1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thehunter1/32/80190_2.png) [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\
**Post date:** [January 14, 2021, 3:53pm UTC](https://discuss.elastic.co/t/threshold-rule-unexpected-result/260956/6 "2021-01-14T15:53:47Z")

</div>

Thanks for your explanation, now I understand well the difference between the 2 alerts 😊

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 11, 2021, 3:54pm UTC](https://discuss.elastic.co/t/threshold-rule-unexpected-result/260956/7 "2021-02-11T15:54:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.