Skip to main content
Question

The curated rule "Extortion Email Detected via Subject Keywords" is not triggering alerts (alerting is turned on for that rule for both precise and broad), even though creating an equivalent rule manually results in successful detections.

  • May 6, 2026
  • 0 replies
  • 10 views

NASEEF
Forum|alt.badge.img+8

hello Team ,
I’m observing that the curated rule “Extortion Email Detected via Subject Keywords” is not generating any alerts in my environment even though alerting is turned on for that rule for both precise and broad. However, when I create a custom detection rule with the same logic, as curated  it successfully triggers alerts on the same dataset.

I’m trying to understand the gap between curated and custom detections in this case.

Has anyone encountered a similar issue where:

  • Curated rules do not fire, but equivalent custom rules do?

Any insights would be helpful.