diff --git a/docs/ml/creating-jobs.asciidoc b/docs/ml/creating-jobs.asciidoc
index 3ad18bc475e1..4fc3e385d73c 100644
--- a/docs/ml/creating-jobs.asciidoc
+++ b/docs/ml/creating-jobs.asciidoc
@@ -20,19 +20,28 @@ than running multiple jobs against the same data.
 
 A _population job_ detects activity that is unusual compared to the behavior of
 the population. For more information, see
-{stack-ov}/ml-configuring-pop.html[Performing Population Analysis].
+{stack-ov}/ml-configuring-pop.html[Performing population analysis].
 
 An _advanced job_ can contain multiple detectors and enables you to configure all
 job settings.
 
 {kib} can also recognize certain types of data and provide specialized wizards
-for that context.  For example, if you use {filebeat-ref}/index.html[Filebeat]
+for that context.  For example, if you use {filebeat-ref}/index.html[{filebeat}]
 to ship access logs from your
 http://nginx.org/[Nginx] and https://httpd.apache.org/[Apache] HTTP servers to
 {es}, the following wizards appear:
 
 [role="screenshot"]
-image::ml/images/ml-data-recognizer.jpg[A screenshot of the Apache and NGINX job creation wizards]
+image::ml/images/ml-data-recognizer-filebeat.jpg[A screenshot of the {filebeat} job creation wizards]
+
+Likewise, if you use {auditbeat-ref}/index.html[{auditbeat}] to audit process
+activity on your systems, the following wizards appear:
+
+[role="screenshot"]
+image::ml/images/ml-data-recognizer-auditbeat.jpg[A screenshot of the {auditbeat} job creation wizards]
+
+These wizards create {ml} jobs, dashboards, searches, and visualizations that
+are customized to help you analyze your {auditbeat} and {filebeat} data.
 
 If you are not certain which type of job to create, you can use the
 *Data Visualizer* to learn more about your data and to identify possible fields
diff --git a/docs/ml/images/ml-data-recognizer-auditbeat.jpg b/docs/ml/images/ml-data-recognizer-auditbeat.jpg
new file mode 100644
index 000000000000..d3a29e4cc797
Binary files /dev/null and b/docs/ml/images/ml-data-recognizer-auditbeat.jpg differ
diff --git a/docs/ml/images/ml-data-recognizer-filebeat.jpg b/docs/ml/images/ml-data-recognizer-filebeat.jpg
new file mode 100644
index 000000000000..ca8f4d36db36
Binary files /dev/null and b/docs/ml/images/ml-data-recognizer-filebeat.jpg differ
diff --git a/docs/ml/images/ml-data-recognizer.jpg b/docs/ml/images/ml-data-recognizer.jpg
deleted file mode 100644
index c781b332a13d..000000000000
Binary files a/docs/ml/images/ml-data-recognizer.jpg and /dev/null differ