My First Rule

calendar May 22, 2024 · Use Case: Guided Onboarding  ·
Share on: linkedin copy

This rule helps you test and practice using alerts with Elastic Security as you get set up. It’s not a sign of threat activity.

Elastic rule (View on GitHub)

 1[metadata]
 2creation_date = "2022/09/22"
 3maturity = "production"
 4updated_date = "2024/05/21"
 5
 6[rule]
 7author = ["Elastic"]
 8description = """
 9This rule helps you test and practice using alerts with Elastic Security as you get set up. It’s not a sign of threat
10activity.
11"""
12enabled = false
13false_positives = [
14    "This rule is not looking for threat activity. Disable the rule if you're already familiar with alerts.",
15]
16from = "now-30m"
17index = ["auditbeat-*", "filebeat-*", "logs-*", "winlogbeat-*"]
18interval = "24h"
19language = "kuery"
20license = "Elastic License v2"
21max_signals = 1
22name = "My First Rule"
23note = """This is a test alert.
24
25This alert does not show threat activity. Elastic created this alert to help you understand how alerts work.
26
27For normal rules, the Investigation Guide will help analysts investigate alerts.
28
29This alert will show once every 24 hours for each host. It is safe to disable this rule.
30"""
31references = ["https://www.elastic.co/guide/en/security/current/prebuilt-rules.html"]
32risk_score = 21
33rule_id = "a198fbbd-9413-45ec-a269-47ae4ccf59ce"
34severity = "low"
35tags = ["Use Case: Guided Onboarding"]
36timestamp_override = "event.ingested"
37type = "threshold"
38
39query = '''
40event.kind:event
41'''
42
43
44
45[rule.threshold]
46field = ["host.name"]
47value = 1

This is a test alert.

This alert does not show threat activity. Elastic created this alert to help you understand how alerts work.

For normal rules, the Investigation Guide will help analysts investigate alerts.

This alert will show once every 24 hours for each host. It is safe to disable this rule.

References

to-top