Forum Discussion
Solved
Introduction to Detection Engineering: Ep.5 – Custom Alerting
I've spent too much time trying to figure this out.
fwiw I had to do this a few times before it worked - Patience is key.
Once the data view is setup and you have working code, it can take 5-10 minutes for the events to show, then the token appears once all are present, if token isn't apparent then just put token in the search bar and it'll be there if you have captured all events. keep refreshing etc.
How do you even go about creating the function needed for this stuff? The rest of the collection was focused more on Elastic and Kibana compared to this
