github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-24 09:48:58 -04:00
Code Issues Projects Releases Packages Wiki Activity

[ML] Fix datafeed of auth_high_count_logon_events_for_a_source_ip anomaly detection job (#149524)

Browse source
This commit is contained in:
Kirti Sodhi 2023-01-26 10:31:17 -05:00 • committed by GitHub
parent 85b5351c90
commit da929fc667
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 19 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

30
x-pack/plugins/ml/server/models/data_recognizer/modules/security_auth/ml/datafeed_auth_high_count_logon_events_for_a_source_ip.json
View file

@ -5,16 +5,24 @@
],
"max_empty_searches": 10,
"query": {
"bool": {
"filter": [{"exists": {"field": "source.ip"}}],
"must": [
{"bool": {
"should": [
{"term": {"event.category": "authentication"}},
{"term": {"event.outcome": "success"}}
]
}}
]
"bool": {
"filter": [
{
"exists": {
"field": "source.ip"
}
},
{
"term": {
"event.category": "authentication"
}
},
{
"term": {
"event.outcome": "success"
}
}
]
}
}
}
}