# Elastic Machine Learning - Pre Built Rules

**URL:** <https://discuss.elastic.co/t/elastic-machine-learning-pre-built-rules/305178>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-machine-learning\
**Created:** [May 19, 2022, 11:17am UTC](https://discuss.elastic.co/t/elastic-machine-learning-pre-built-rules/305178 "2022-05-19T11:17:04Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![geetika\_gopi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/geetika_gopi/32/93548_2.png) [@geetika\_gopi](https://discuss.elastic.co/u/geetika_gopi)\
**Post date:** [May 19, 2022, 11:17am UTC](https://discuss.elastic.co/t/elastic-machine-learning-pre-built-rules/305178/1 "2022-05-19T11:17:04Z")

</div>

Hello,

For some of the windows pre-built ML jobs, we noticed the datafeed configured was as follows:

```auto
{
  "bool": {
    "filter": [
      {
        "term": {
          "destination.ip": "169.254.169.254"
        }
      }
    ]
  }
}

```

Now when I queried these manually on my historical winlogbeat logs, elastic returned no such events. Which means my ML job essentially has no datafeed (or sample data) to analyse/work on.

Subsequently we noticed the following job messages:

1. Datafeed has been retrieving no data for a while
2. Datafeed stopped
3. Job is closing

Does it just mean that my ML job has no input records to initialize. If that is the case, why does the job get closed? Shouldn't it just keep looking?

Apologies in advance if my understanding is incorrect. Appreciate the support.

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [May 19, 2022, 4:46pm UTC](https://discuss.elastic.co/t/elastic-machine-learning-pre-built-rules/305178/2 "2022-05-19T16:46:16Z")

</div>

Perhaps @Craig_Chamberlain can verify here, but I'm sure that all pre-built jobs wouldn't have a filter for a specific IP address. Can you tell us what job this is (it's name)?

---

<div class="post-metadata">

**Author:** ![Craig\_Chamberlain](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/craig_chamberlain/32/70079_2.png) [@Craig\_Chamberlain](https://discuss.elastic.co/u/Craig_Chamberlain)\
**Post date:** [May 19, 2022, 4:57pm UTC](https://discuss.elastic.co/t/elastic-machine-learning-pre-built-rules/305178/3 "2022-05-19T16:57:18Z")

</div>

This is one of the jobs that looks for anomalous / suspicious activity involving the metadata service in a cloud environment. The job is for virtual instances running in cloud environments and can be stopped if there are no cloud instances instrumented with endpoints or agents.

---

<div class="post-metadata">

**Author:** ![geetika\_gopi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/geetika_gopi/32/93548_2.png) [@geetika\_gopi](https://discuss.elastic.co/u/geetika_gopi)\
**Post date:** [May 20, 2022, 3:20pm UTC](https://discuss.elastic.co/t/elastic-machine-learning-pre-built-rules/305178/4 "2022-05-20T15:20:15Z")

</div>

Thanks @Craig_Chamberlain,

Could you tell me about this job: v2\_windows\_anomalous\_network\_activity\_ecs  
If there are no historical events are found according to the configured datafeed filter, the ML job goes to closed state. How do we prevent this from happening?

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [May 21, 2022, 10:45am UTC](https://discuss.elastic.co/t/elastic-machine-learning-pre-built-rules/305178/5 "2022-05-21T10:45:46Z")

</div>

All that I can say is that if you look at how the original job is constructed, there is no such filter.

See the out-of-the-box datafeed configuration on Github:

> <https://github.com/elastic/kibana/blob/8.2/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/datafeed_v2_windows_anomalous_network_activity_ecs.json>

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 18, 2022, 10:46am UTC](https://discuss.elastic.co/t/elastic-machine-learning-pre-built-rules/305178/6 "2022-06-18T10:46:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.