Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[ML] Add support for searchable GUID anomaly detection job tag #101877

Closed
peteharverson opened this issue Jun 10, 2021 · 1 comment · Fixed by #102099
Closed

[ML] Add support for searchable GUID anomaly detection job tag #101877

peteharverson opened this issue Jun 10, 2021 · 1 comment · Fixed by #102099
Assignees
Labels
enhancement New value added to drive a business result Feature:Anomaly Detection ML anomaly detection :ml v7.14.0

Comments

@peteharverson
Copy link
Contributor

peteharverson commented Jun 10, 2021

Job tags are being added to anomaly detection jobs in security modules to provide additional metadata equivalent. One of these fields is a GUID, which will be used to precisely identify the job. The tags will be stored inside a job_tags field added to the existing custom_settings field, with the GUID field being euid ('Elastic unique identifier'), for example:

  "custom_settings": {
    "created_by": "ml-module-security-windows",
    "job_tags": {
      "euid": "8015",
      "name": "many-usernames-from-a-source-ip",
      "event.category": "authentication",
      "maturity": "experimental",
      "author": "@randomuserid",
      "version": "1",
      "updated_date": "5/12/2021"
   }
}
  • The euid field needs to be searchable from the jobs list, using a text based search (i.e. no need to support e.g. `euid >= 9000). There is no need at this stage to highlight in the job row why the job has matched the euid search term.
  • The job_tags field must be retained when the job is cloned.
  • If job_tags exist, then should be enumerated and displayed in the job list row expansion. These are manually configured by security operators so values may change.
@peteharverson peteharverson added enhancement New value added to drive a business result :ml Feature:Anomaly Detection ML anomaly detection v7.14.0 labels Jun 10, 2021
@elasticmachine
Copy link
Contributor

Pinging @elastic/ml-ui (:ml)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New value added to drive a business result Feature:Anomaly Detection ML anomaly detection :ml v7.14.0
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants