Elastic low stable eql
Anomalous Process For a Linux Population
Searches for rare processes running on multiple Linux hosts in an entire fleet or network. This reduces the detection of false positives since automated maintenance processes usually only run occasionally on a single machine but are common to all or many hosts in a fleet.
Detection Logic
False Positives
- ⚠ A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this alert.
Field Validations
Loading…
Comments (0)
Loading comments...