Silent rule

A silent rule is a detection that stops producing alerts because it is failing, disabled or starved of data, not because there is nothing to find. It is dangerous because silence looks like safety. Catching it needs run status, error logs or gap tracking.

What Silent rule means here

Silent rules come from a query error, a skipped schedule window, a source that stopped sending logs or an auto-disable after repeated failures.

Look for a per-rule execution status, a record of the last successful run and a measure of how much event time was not searched.

Example of Silent rule in Elastic Security documentation

Elastic reports rule execution status as succeeded, failed or warning, and its Rule Monitoring view shows gap duration, the source event time not searched between a run and the one before it. elastic.co read 2026-11-03

Terms related to Silent rule

• Rule health: Rule health is whether a detection still runs, still sees its data and still earns its alerts.
• Log source health: Log source health is whether each log source is sending data on time and in the expected shape.
• Field drift: Field drift is when the fields a rule depends on change name, type or meaning, or stop appearing, so the rule quietly stops matching.

The matrix scores platforms on whether they document these ideas: see the matrix and the full glossary.