# Issues with builtin network ML job high\_count\_network\_denies

**URL:** <https://discuss.elastic.co/t/issues-with-builtin-network-ml-job-high-count-network-denies/280635>\
**Category:** Kibana\
**Tags:** elastic-stack-machine-learning\
**Created:** [August 6, 2021, 9:49am UTC](https://discuss.elastic.co/t/issues-with-builtin-network-ml-job-high-count-network-denies/280635 "2021-08-06T09:49:19Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Post date:** [August 6, 2021, 9:49am UTC](https://discuss.elastic.co/t/issues-with-builtin-network-ml-job-high-count-network-denies/280635/1 "2021-08-06T09:49:19Z")

</div>

Hello,

Just tried the new builtin network ML jobs.. First of all, our Elastic stack crashed after adding the ML jobs through the wizard. After recovering one of the four jobs, `high_count_network_denies`, seemed to not process anything. Just analysed it and it seems related to the datafeed...

`high_count_network_denies` has as filter:

`{"bool":{"filter":[{"term":{"event.category":"network"}},{"term":{"event.outcome":"deny"}}]}}`

But the panw dataset does not set `event.outcome` to `deny`:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/b/bb0b4924514e30361f3a4eeaf04160e9e9dc1ea8.png)

Considering that the ECS categorization documentation says:

> **[ECS Categorization Field: event.outcome | Elastic Common Schema (ECS)...](https://www.elastic.co/guide/en/ecs/current/ecs-allowed-values-event-outcome.html)**

![image](https://us1.discourse-cdn.com/elastic/original/3X/8/f/8f86c3ac6aa5fe7e93d5ff99ef05a11d59a76b97.png)

I guess that the ML job has a bug and that the event.outcome field actually has to be the `event.type` field and the value `denied` instead of `deny`?

Grtz

Willem

---

<div class="post-metadata">

**Author:** ![Craig\_Chamberlain](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/craig_chamberlain/32/70079_2.png) [@Craig\_Chamberlain](https://discuss.elastic.co/u/Craig_Chamberlain)\
**Post date:** [August 8, 2021, 8:12pm UTC](https://discuss.elastic.co/t/issues-with-builtin-network-ml-job-high-count-network-denies/280635/2 "2021-08-08T20:12:09Z")

</div>

Hi, that data feed query was updated in 7.13.2 with an additional test for an `event.type` value of `denied`. The updated query, in the updated job, should work with most any ECS compatible network events. . The latest ML job is in version 7.13.4 and 7.14.0 at the time of this writing. Alternatively, you can clone the job and use the newer data feed query from the upated job here: [Update datafeed\_high\_count\_network\_denies.json by randomuserid · Pull Request #101681 · elastic/kibana · GitHub](https://github.com/elastic/kibana/pull/101681/files)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 5, 2021, 8:12pm UTC](https://discuss.elastic.co/t/issues-with-builtin-network-ml-job-high-count-network-denies/280635/3 "2021-09-05T20:12:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.