I am attempting to create a ML job to detect rare source IPs. Using the Anomaly Detection wizard, I selected Categorization, then picked Rare and picked the source.address for Categorization field. However, I get the following error: Selected category field is invalid 1000 field values analyzed, 0%…

Anomaly Detection for Rare IPs

richcollier (rich collier) September 12, 2022, 11:03am 2

Categorization is used to process unstructured text, not to deal with fields like IP addresses. You can just apply rare to the IP address by setting the IP address as the by_field. See this older article for examples.

Also, see this other idea about only analyzing the first octet of IP addresses

1 Like

Topic		Replies	Views
ML job rare function to detect anomaly on IP address will report IP on same network as anomaly Kibana elastic-stack-machine-learning	3	607	September 24, 2020
Category examples not available in Machine Learning module 5.5 Elasticsearch elastic-stack-machine-learning	4	958	September 27, 2017
ML: how to find anomaly from ip address Kibana elastic-stack-machine-learning	6	1379	August 6, 2020
Anomaly detection in Machine learning kibana Kibana elastic-stack-machine-learning	7	516	December 23, 2021
Question on how to choose the aggregations for ML job Kibana elastic-stack-machine-learning	3	362	December 10, 2019

Anomaly Detection for Rare IPs

Related topics