I am trying to set up a machine learning job to detect when non admin users who normally do not use powershell start powershell.
I already saved a search function that shows powershell started logs, and filters the unimportant users:
event.action: "created-process" and process.name: "powershell.exe" and not related.user: (*$ or adm_*)
Now I thought the way to go is to use the data from the saved search in a machine learning job running a rare detector with related.user as the field. My thinking is that this way it finds when powershell was started, and registers an anomaly when someone runs it who does not usually use powershell. However, searching for rare by "related.user" does not seem to be an option in Elasticsearch. Does anyone have an example of how I could set this up?
The UI is suggesting you use related.user.keyword (the keyword type version of related.user). This will work for you.
If you did not know this, the index "mappings" are definitions of the fields and their types. A long time ago, string-based fields (like fields that defined the names of things) were replaced with text and keyword types.