# Anomaly Detection for Rare IPs

**URL:** <https://discuss.elastic.co/t/anomaly-detection-for-rare-ips/314013>\
**Category:** Elastic Stack\
**Tags:** elastic-stack-machine-learning\
**Created:** [September 8, 2022, 5:58pm UTC](https://discuss.elastic.co/t/anomaly-detection-for-rare-ips/314013 "2022-09-08T17:58:31Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [September 12, 2022, 11:03am UTC](https://discuss.elastic.co/t/anomaly-detection-for-rare-ips/314013/2 "2022-09-12T11:03:24Z")

</div>

[Categorization](https://www.youtube.com/watch?v=wPd_JWWfre4) is used to process unstructured text, not to deal with fields like IP addresses. You can just apply `rare` to the IP address by setting the IP address as the `by_field`. See this [older article](https://discuss.elastic.co/t/dec-4th-2018-en-ml-rarity-analysis-with-machine-learning/158979) for examples.

Also, see this [other idea](https://discuss.elastic.co/t/ml-job-rare-function-to-detect-anomaly-on-ip-address-will-report-ip-on-same-network-as-anomaly/246213) about only analyzing the first octet of IP addresses

---

_[View the full topic](https://discuss.elastic.co/t/anomaly-detection-for-rare-ips/314013)._