Just tried the new builtin network ML jobs.. First of all, our Elastic stack crashed after adding the ML jobs through the wizard. After recovering one of the four jobs,
high_count_network_denies, seemed to not process anything. Just analysed it and it seems related to the datafeed...
high_count_network_denies has as filter:
But the panw dataset does not set
Considering that the ECS categorization documentation says:
I guess that the ML job has a bug and that the event.outcome field actually has to be the
event.type field and the value
denied instead of