# Custom Machine Learning Model on Elastic Security

**URL:** <https://discuss.elastic.co/t/custom-machine-learning-model-on-elastic-security/341862>\
**Category:** Elastic Security\
**Created:** [August 29, 2023, 8:05am UTC](https://discuss.elastic.co/t/custom-machine-learning-model-on-elastic-security/341862 "2023-08-29T08:05:45Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![xynobob](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xynobob/32/105064_2.png) [@xynobob](https://discuss.elastic.co/u/xynobob)\
**Post date:** [August 29, 2023, 8:05am UTC](https://discuss.elastic.co/t/custom-machine-learning-model-on-elastic-security/341862/1 "2023-08-29T08:05:45Z")

</div>

Hi, I am doing a small side project and this is my first time diving into Elastic Security. Read several documentations, however it doesn't clarify my doubt, so am asking here instead. So my question is -

Is it possible to use/load a custom Machine Learning Model (to detect threats) on Elastic Security that will be running against my ingested logs (currently already available under Observability \> Logs) so that alerts can be generated? To my understanding, custom ML Models can be used by using Eland however how do I incorporate it to Elastic Security. Appreciate any help.

Thank you.

---

<div class="post-metadata">

**Author:** ![sholzhauer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sholzhauer/32/110282_2.png) [@sholzhauer](https://discuss.elastic.co/u/sholzhauer)\
**Post date:** [August 29, 2023, 2:20pm UTC](https://discuss.elastic.co/t/custom-machine-learning-model-on-elastic-security/341862/2 "2023-08-29T14:20:26Z")

</div>

If I understand your question correctly you want to have a custom ML model loaded in Elastic Agent's Defend integration on your hosts.

This is not supported to my knowledge.

---

<div class="post-metadata">

**Author:** ![xynobob](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xynobob/32/105064_2.png) [@xynobob](https://discuss.elastic.co/u/xynobob)\
**Post date:** [August 30, 2023, 7:42am UTC](https://discuss.elastic.co/t/custom-machine-learning-model-on-elastic-security/341862/3 "2023-08-30T07:42:37Z")

</div>

Hi, thank you for the reply. Oh, not really referring to the integration because if my understanding is correct, Elastic Defend integration does live 'monitoring' on each particular agent right? But what I already have is a bunch of baseline & malicious logs that already has been ingested into Elastic from a simulated environment I created (and I am no longer ingesting anything in real time) that I would want to run against a custom ML model and then make use of Elastic Security dashboard/alerts feature to show the findings. Not too sure if its a plausible use case of Elastic Security, thus wanting to find out.

---

<div class="post-metadata">

**Author:** ![xynobob](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xynobob/32/105064_2.png) [@xynobob](https://discuss.elastic.co/u/xynobob)\
**Post date:** [September 12, 2023, 10:38am UTC](https://discuss.elastic.co/t/custom-machine-learning-model-on-elastic-security/341862/4 "2023-09-12T10:38:52Z")

</div>

Any updates on this? Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 10, 2023, 10:39am UTC](https://discuss.elastic.co/t/custom-machine-learning-model-on-elastic-security/341862/5 "2023-10-10T10:39:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.