Skip to content

Commit 16da319

Browse files
authored
Add details for the new Security: Host module to OOTB ML jobs doc (#2909)
Add details for the new security host module to ootb ml jobs doc
1 parent 1135de2 commit 16da319

File tree

1 file changed

+34
-1
lines changed

1 file changed

+34
-1
lines changed

docs/en/stack/ml/anomaly-detection/ootb-ml-jobs-siem.asciidoc

Lines changed: 34 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,39 @@ for data that matches the query.
116116
|===
117117
// end::security-cloudtrail-jobs[]
118118

119+
[discrete]
120+
[[security-host-jobs]]
121+
== Security: Host
122+
123+
Anomaly detection jobs for host-based threat hunting and detection.
124+
125+
In the {ml-app} app, these configurations are available only when data exists
126+
that matches the query specified in the
127+
https://github.com/elastic/kibana/blob/{branch}/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/security_host/manifest.json[manifest file].
128+
In the {security-app}, it looks in the {data-source} specified in the
129+
{kibana-ref}/advanced-options.html#securitysolution-defaultindex[`securitySolution:defaultIndex` advanced setting]
130+
for data that matches the query.
131+
132+
To access the host traffic anomalies dashboard in Kibana, go to: `Security -> Dashboards -> Host Traffic Anomalies`.
133+
134+
// tag::security-host-jobs[]
135+
136+
|===
137+
|Name |Description |Job |Datafeed
138+
139+
|high_count_events_for_a_host_name
140+
|Looks for a sudden spike in host based traffic. This can be due to a range of security issues, such as a compromised system, DDoS attacks, malware infections, privilege escalation, or data exfiltration.
141+
|https://github.com/elastic/kibana/blob/{branch}/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/security_host/ml/high_count_events_for_a_host_name.json[image:images/link.svg[A link icon]]
142+
|https://github.com/elastic/kibana/blob/{branch}/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/security_host/ml/datafeed_high_count_events_for_a_host_name.json[image:images/link.svg[A link icon]]
143+
144+
|low_count_events_for_a_host_name
145+
|Looks for a sudden drop in host based traffic. This can be due to a range of security issues, such as a compromised system, a failed service, or a network misconfiguration.
146+
|https://github.com/elastic/kibana/blob/{branch}/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/security_host/ml/low_count_events_for_a_host_name.json[image:images/link.svg[A link icon]]
147+
|https://github.com/elastic/kibana/blob/{branch}/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/security_host/ml/datafeed_low_count_events_for_a_host_name.json[image:images/link.svg[A link icon]]
148+
149+
|===
150+
// end::security-host-jobs[]
151+
119152
[discrete]
120153
[[security-linux-jobs]]
121154
== Security: Linux
@@ -548,4 +581,4 @@ The job configurations and datafeeds can be found
548581
https://github.com/elastic/integrations/blob/main/packages/lmd/kibana/ml_module/lmd-ml.json[here].
549582

550583
// end::security-windows-jobs[]
551-
// end::siem-jobs[]
584+
// end::siem-jobs[]

0 commit comments

Comments
 (0)