Elastic high stable kql

Multiple Machine Learning Alerts by Influencer Field

This rule uses alerts data to determine when multiple unique machine learning jobs involving the same influencer field are triggered. Analysts can use this to prioritize triage and response machine learning alerts.

View Source

Detection Logic

from .alerts-security.*
| where kibana.alert.rule.type == "machine_learning" and
  not KQL("""kibana.alert.rule.tags : "Rule Type: Higher-Order Rule" """)
| stats Esql.count_distinct_job_id = COUNT_DISTINCT(job_id),
        Esql.job_id_values = VALUES(job_id),
        Esql.rule_name_values = VALUES(kibana.alert.rule.name),
        Esql.influencer_field_values = VALUES(influencers.influencer_field_values),
        Esql.influencer_field_name = VALUES(influencers.influencer_field_name) by influencers.influencer_field_values, process.name, host.name
| where Esql.count_distinct_job_id >= 3 and not influencers.influencer_field_values in ("root", "SYSTEM")
| KEEP influencers.influencer_field_values, process.name, host.name, Esql.*

Field Validations

Loading…

Comments (0)

Loading comments...