# Unable to create new rule

**URL:** https://discuss.elastic.co/t/unable-to-create-new-rule/379709
**Category:** Kibana
**Tags:** elastic-stack-alerting
**Created:** [July 2, 2025, 1:06pm UTC](https://discuss.elastic.co/t/unable-to-create-new-rule/379709 "2025-07-02T13:06:29Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Devanshu-soni](https://avatars.discourse-cdn.com/v4/letter/d/ba9def/32.png) [@Devanshu-soni](https://discuss.elastic.co/u/Devanshu-soni)
#### Post date: [July 2, 2025, 1:06pm UTC](https://discuss.elastic.co/t/unable-to-create-new-rule/379709/1 "2025-07-02T13:06:29Z")

</div>

Hello,

I'm trying to create a rule using 'Search threshold rule' bases alerting option in Discover.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/e/5e3e7cf10e1417e7be49f87557e422f974ebb49a.png)

Could anybody point out what additional user role is required to create new rule and alert. Currently my account has following roles allowed - watcher, watcher\_admin, read\_only, Dashboards\_write\_permissions, Alerts and Insights permissions

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [July 2, 2025, 2:54pm UTC](https://discuss.elastic.co/t/unable-to-create-new-rule/379709/2 "2025-07-02T14:54:44Z")

</div>

Hi @Devanshu-soni Welcome to the community

What version are you on?

Please go to Kibana -\> Dev Tools and run

`GET _security/user/_privileges`

And show the entire result.

Most likely you have been limited on which indices you can access...

---

<div class="post-metadata">

### Author: ![Devanshu-soni](https://avatars.discourse-cdn.com/v4/letter/d/ba9def/32.png) [@Devanshu-soni](https://discuss.elastic.co/u/Devanshu-soni)
#### Post date: [July 2, 2025, 4:24pm UTC](https://discuss.elastic.co/t/unable-to-create-new-rule/379709/3 "2025-07-02T16:24:43Z")

</div>

Hello @stephenb, thanks for responding. Currently I'm working on version 8.17.3  
Also below is the output you requested.

```auto
{
  "cluster": [
    "all",
    "manage_enrich",
    "manage_watcher",
    "monitor",
    "monitor_enrich"
  ],
  "global": [],
  "indices": [
    {
      "names": [
        "*"
      ],
      "privileges": [
        "all",
        "create_index",
        "cross_cluster_replication",
        "manage",
        "monitor",
        "read",
        "view_index_metadata",
        "write"
      ],
      "allow_restricted_indices": false
    },
    {
      "names": [
        ".triggered_watches",
        ".watcher-history-*",
        ".watches"
      ],
      "privileges": [
        "read"
      ],
      "allow_restricted_indices": true
    }
  ],
  "applications": [
    {
      "application": "kibana-.kibana",
      "privileges": [
        "feature_rulesSettings.all",
        "feature_visualize.read",
        "feature_maps.read",
        "feature_discover.generate_report",
        "feature_ml.read",
        "feature_graph.read",
        "feature_dashboard.download_csv_report",
        "feature_discover.minimal_all",
        "feature_discover.store_search_session",
        "feature_canvas.read",
        "feature_dashboard.minimal_read"
      ],
      "resources": [
        "space:default"
      ]
    },
    {
      "application": "kibana-.kibana",
      "privileges": [
        "feature_savedObjectsTagging.read",
        "feature_fleet.read",
        "feature_ml.all",
        "feature_advancedSettings.read",
        "feature_generalCases.read",
        "feature_fleetv2.read",
        "feature_actions.read",
        "feature_aiAssistantManagementSelection.read",
        "feature_maintenanceWindow.read",
        "feature_graph.all",
        "feature_filesManagement.read",
        "feature_stackAlerts.read",
        "feature_rulesSettings.read",
        "feature_dashboard.all",
        "feature_canvas.all",
        "feature_dev_tools.all",
        "feature_discover.all",
        "feature_osquery.read",
        "feature_maps.all",
        "feature_visualize.all",
        "feature_savedObjectsManagement.read",
        "feature_filesSharedImage.read",
        "feature_indexPatterns.all"
      ],
      "resources": [
        "*"
      ]
    }
  ],
  "run_as": []
}

```

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [July 2, 2025, 5:29pm UTC](https://discuss.elastic.co/t/unable-to-create-new-rule/379709/4 "2025-07-02T17:29:38Z")

</div>

I suspect these need to be `all`

> [@Devanshu-soni](#):
>
> ` "feature_actions.read",`

> [@Devanshu-soni](#):
>
> ` "feature_rulesSettings.read",`

> [@Devanshu-soni](#):
>
> ` "feature_stackAlerts.read",`

Also I expect you may need `all` on these indices in the restricted indices section

` ".internal.alerts-*"`