Hello,
I saw this post (link) and wanted to try on my network log,
so i followed the github manual (link), uploaded all the required scripts and changed only the transform script, just to apply it to my already existing index, like below.
PUT _transform/ml_beaconing_pivot_transform
{
"dest": {
"index": "my_dst_index",
"pipeline": "ml_beaconing_ingest_pipeline"
},
"frequency": "1h",
"pivot": {
"aggregations": {
"@timestamp": {
"max": {
"field": "@timestamp"
}
},
"beacon_stats": {
"scripted_metric": {
"combine_script": "return state",
"init_script": {
"id": "ml_beaconing_init_script"
},
"map_script": {
"id": "ml_beaconing_map_script"
},
"params": {
"destination_bytes": "dst_bytes",
"destination_ip": "destination.ip",
"max_beaconing_bytes_cov": 0.05,
"max_beaconing_count_rv": 0.1,
"max_jitter": 0,
"min_beaconing_count_autocovariance": 0.7,
"min_not_empty": 0.5,
"min_number_periods": 6,
"number_buckets_in_range": 360,
"number_destination_ips": 10,
"source_bytes": "src_bytes",
"time_bucket_length": 60,
"time_field": "@timestamp",
"truncate_at": [
0.1,
0.8
]
},
"reduce_script": {
"id": "ml_beaconing_reduce_script"
}
}
}
},
"group_by": {
"host.name": {
"terms": {
"field": "host.hostname"
}
}
}
},
"source": {
"index": [
"my_src_index"
]
},
"sync": {
"time": {
"delay": "120s",
"field": "@timestamp"
}
}
}
i changed 'group_by', 'destination_bytes', 'source_bytes' value to match my index format.
But it didn't work out, instead caused error like below
{
"error" : {
"root_cause" : [
{
"type" : "parse_exception",
"reason" : "request body is required"
}
],
"type" : "parse_exception",
"reason" : "request body is required"
},
"status" : 400
}
I'd like to know what's the problem and if there's any way to apply this beaconing detection script to my already existing index.
Thanks in advance
