The pre-built jobs are basically stored as kibana plugin "models" - you can see them all in this GH repo: kibana/x-pack/plugins/ml/server/models/data_recognizer/modules at 7.15 · elastic/kibana · GitHub
for example: rare destination by country
job: https://github.com/elastic/kibana/blob/7.15/x-pack/plugins/ml/server/models/data_r[…]nizer/modules/security_network/ml/rare_destination_country.json
datafeed: https://github.com/elastic/kibana/blob/7.15/x-pack/plugins/ml/server/models/data_r[…]ules/security_network/ml/datafeed_rare_destination_country.json
In the Kibana UI, once the user clicks on "enable" - Kibana just reads these static files and calls the _ml
API with the details and the jobs get created.
You now have all the information on how to call the _ml
API to create these jobs.