Correlation Search not creating a notable event, but is triggering email alerts.

[dlevesque1]

Hello,

I am trying to create a notable event in the mission control area within Enterprise Security to capture when an index has not received data within 24 hours. This should be simple and straight forward but I can't seem to figure out why this isn't working. 

I have the detection search as 
index = <target index>
|stats count

condition in the alert to trigger is
search count = 0

I also have email alerts setup as an additional way to notify the proper people,  this part of the security content works, but why doesn't the actual event appear in the Mission control area? This has me stumped, any help would be greatly appreciated.

[livehybrid]

Hi @dlevesque1 

Have you created this through the "Content Management" section within ES or is this a correlation search that you have created with the notable alert action? Ensure that you are creating from within the Content Management section if not already.

Which version of ES are you using?

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[PickleRick]

If I remember correctly, the alert created "normally" with a "create notable" action should work as well (although it will have less configuration options). But in order to be able to create notables the user who the alert is run with must have proper privileges within the ES app. So if an alert was created with a normal alert creation means instead of ES Content Management, the user might not be able to create notable due to insufficient permissions. (yes, I'm aware that it sounds a bit convoluted).