Hi Everyone, I'm currently developing and testing a Machine Learning-based use case in Elastic for anomaly detection. I've cloned and configured the ML job "auth_rare_hour_for_a_user", which is designed to detect user logins at unusual hours. The job is active and appears to be functioning correctl…

Thanks for reaching out, @sunith . I have a few follow-up questions here: What version of Elastic are you using? Could you provide more information about how this alert is configured? Attaching a picture of the configuration could also be helpful. Best, Jessica

Thanks for following up, @sunith . One thing that has tripped me up with anomaly detection in the past is that it requires a sufficient amount of baseline data (typically 2-4 weeks) to establish standard patterns before detecting anomalies reliably. Could this be what's happening here?

Thanks for the reply. Yes, for baseline data I gave 1 month of data to this job.

Thanks for following up, @sunith . As a next step, please verify that the bucket span is appropriate for your use case (typically 15 minutes to 1 hour for login patterns).

[image] sunith: Yes, for baseline data I gave 1 month of data to this job. It is also important that the baseline includes many examples of "normal" login times for the particular user you are testing. You should have dozens or even hundreds of "normal" examples of logins for that user before…

Discuss the Elastic Stack

Machine learning use case - Anomaly Detection

Elastic Security SIEM

sunith (Sunith) July 2, 2025, 12:54pm 3

Thanks for the reply @jessgarson

Elastic version 8.18.3

Screenshot of the ML rule and associated job

Topic		Replies	Views
ML anomaly detection alert SIEM	1	81	April 22, 2025
Trigering Alerts for Machine learning Jobs SIEM	3	181	August 1, 2024
Signal detection ML rule not working SIEM	1	467	September 19, 2020
How to generate Rules for anomaly detection ML? Elasticsearch elastic-stack-machine-learning	5	589	November 1, 2021
SIEM detections SIEM	3	520	August 4, 2020

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Machine learning use case - Anomaly Detection

Related topics