# Enable Elastic Security prebuilt ML jobs \[2\]

**URL:** <https://discuss.elastic.co/t/enable-elastic-security-prebuilt-ml-jobs-2/288345>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-machine-learning\
**Created:** [November 3, 2021, 3:36pm UTC](https://discuss.elastic.co/t/enable-elastic-security-prebuilt-ml-jobs-2/288345 "2021-11-03T15:36:20Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![bil\_15](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bil_15/32/82642_2.png) [@bil\_15](https://discuss.elastic.co/u/bil_15)\
**Post date:** [November 3, 2021, 3:36pm UTC](https://discuss.elastic.co/t/enable-elastic-security-prebuilt-ml-jobs-2/288345/1 "2021-11-03T15:36:20Z")

</div>

Hello!  
Reference:  
[[Enable Elastic Security prebuilt rules and ML jobs](https://discuss.elastic.co/t/enable-elastic-security-prebuilt-rules-and-ml-jobs/285061)]

So, I've uploaded ML Jobs bundled with datafeed through API using the request:

```auto
PUT _ml/anomaly_detectors/custom_rare_process_by_host_linux_ecs
{
  "custom_settings" : {
    "created_by" : "ml-module-security-linux",
    "custom_urls" : [
      {
        "url_name" : "Host Details by process name",
        "url_value" : "security/hosts/ml-hosts/$host.name$?_g=()&query=(query:'process.name%20:%20%22$process.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
      },
      {
        "url_name" : "Host Details by user name",
        "url_value" : "security/hosts/ml-hosts/$host.name$?_g=()&query=(query:'user.name%20:%20%22$user.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
      },
      {
        "url_name" : "Hosts Overview by process name",
        "url_value" : "security/hosts/ml-hosts?_g=()&query=(query:'process.name%20:%20%22$process.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
      },
      {
        "url_name" : "Hosts Overview by user name",
        "url_value" : "security/hosts/ml-hosts?_g=()&query=(query:'user.name%20:%20%22$user.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
      }
    ]
  },
  "datafeed_config" : {
    "datafeed_id" : "datafeed-custom_rare_process_by_host_linux_ecs",
    "query_delay" : "87587ms",
    "chunking_config" : {
      "mode" : "auto"
    },
    "indices_options" : {
      "expand_wildcards" : [
        "open"
      ],
      "ignore_unavailable" : false,
      "allow_no_indices" : true,
      "ignore_throttled" : true
    },
    "query" : {
      "bool" : {
        "filter" : [
          {
            "term" : {
              "event.category" : "process"
            }
          },
          {
            "term" : {
              "event.type" : "start"
            }
          }
        ],
        "must" : [
          {
            "bool" : {
              "should" : [
                {
                  "match" : {
                    "host.os.type" : {
                      "query" : "linux",
                      "operator" : "OR"
                    }
                  }
                },
                {
                  "match" : {
                    "host.os.family" : {
                      "query" : "debian",
                      "operator" : "OR"
                    }
                  }
                },
                {
                  "match" : {
                    "host.os.family" : {
                      "query" : "redhat",
                      "operator" : "OR"
                    }
                  }
                },
                {
                  "match" : {
                    "host.os.family" : {
                      "query" : "suse",
                      "operator" : "OR"
                    }
                  }
                },
                {
                  "match" : {
                    "host.os.family" : {
                      "query" : "ubuntu",
                      "operator" : "OR"
                    }
                  }
                }
              ]
            }
          }
        ]
      }
    },
    "indices" : [
      "logs-endpoint.events.*"
    ],
    "scroll_size" : 1000,
    "delayed_data_check_config" : {
      "enabled" : true
    }
  },
  "groups" : [
    "security",
    "endpoint",
    "linux",
    "process"
  ],
  "description" : "This is a new refactored job which works on ECS compatible events across multiple indices. Security: Linux - Looks for processes that are unusual to a particular Linux host. Such unusual processes may indicate unauthorized services, malware, or persistence mechanisms.",
  "analysis_config" : {
    "bucket_span" : "15m",
    "detectors" : [
      {
        "detector_description" : "rare process executions on Linux",
        "function" : "rare",
        "by_field_name" : "process.name",
        "partition_field_name" : "host.name",
        "detector_index" : 0
      }
    ],
    "influencers" : [
      "host.name",
      "process.name",
      "user.name"
    ]
  },
  "analysis_limits" : {
    "model_memory_limit" : "256mb",
    "categorization_examples_limit" : 4
  },
  "data_description" : {
    "time_field" : "@timestamp",
    "time_format" : "epoch_ms"
  },
  "model_snapshot_retention_days" : 10,
  "daily_model_snapshot_retention_after_days" : 1,
  "results_index_name" : "shared",
  "allow_lazy_open" : false
}

```

Than, I'm starting my feed:  
`POST _ml/datafeeds/datafeed-custom_rare_process_by_host_linux_ecs/_start`

And opening ML job:  
`POST _ml/anomaly_detectors/custom_rare_process_by_host_linux_ecs/_open`

Log looks like this:

 ![Screenshot from 2021-11-03 17-32-48](https://us1.discourse-cdn.com/elastic/original/3X/2/9/29a4f84405981aa840ab03ef42e374dc6f4df724.png)

The interesting thing is that I can't start/stop datafeed through UI.  
 ![Screenshot from 2021-11-03 17-33-37](https://us1.discourse-cdn.com/elastic/original/3X/f/3/f3fae57db10c7f3048186e1436e30866ad9acb62.png)

As a result, I can't configure Security rule based on this ML job:  
 ![Screenshot from 2021-11-03 17-35-07](https://us1.discourse-cdn.com/elastic/original/3X/c/e/ce3543d143b84efc1568521a34deba82ea176bb7.png)

Any ideas why is this happening?  
Thanks in advance!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 1, 2021, 3:36pm UTC](https://discuss.elastic.co/t/enable-elastic-security-prebuilt-ml-jobs-2/288345/2 "2021-12-01T15:36:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.