# ML Aggregation and Fields **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-machine-learning\ **Created:** [November 14, 2017, 12:14am UTC](https://discuss.elastic.co/t/ml-aggregation-and-fields/107474 "2017-11-14T00:14:40Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![mathurin68](https://avatars.discourse-cdn.com/v4/letter/m/6bbea6/32.png) [@mathurin68](https://discuss.elastic.co/u/mathurin68)\ **Post date:** [November 14, 2017, 12:14am UTC](https://discuss.elastic.co/t/ml-aggregation-and-fields/107474/1 "2017-11-14T00:14:40Z")
I have x-pack up and running and am collecting event logs containing windows and powershell command line activities. Basically, I want to see the anomalies in command line activity. I don't care about something like this C:\WINDOWS\SysWOW64\DllHost.exe /Processid:{??????????} that happened over 900,000 times I care about the 'anomalies', something like this as an example, that might have happened very few times - psexec -i -s -d cmd.exe /c type test \> C:\Windows\System32\backdoor.bat Isn't this what it's designed for? I've been running it with 'Distinct Count' but I'm thinking that's not what I want, maybe 'low count'? But if I select 'low count' from Aggregation, there's nothing in Fields... Questions - 1. Do I want 'low count'? 2. Why is there nothing in Fields for some of the 'Aggregation' options? Yes, I am going through the machine learning course... Appreciate any explanations! ---
**Author:** ![dmitri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dmitri/32/17997_2.png) [@dmitri](https://discuss.elastic.co/u/dmitri)\ **Post date:** [November 14, 2017, 10:31am UTC](https://discuss.elastic.co/t/ml-aggregation-and-fields/107474/2 "2017-11-14T10:31:09Z")
Hi, I think what you are looking for is using categorization. Have a look [here](https://www.elastic.co/guide/en/x-pack/current/ml-configuring-categories.html) for more details. I hope it helps. ---
**Author:** ![mathurin68](https://avatars.discourse-cdn.com/v4/letter/m/6bbea6/32.png) [@mathurin68](https://discuss.elastic.co/u/mathurin68)\ **Post date:** [November 15, 2017, 3:58am UTC](https://discuss.elastic.co/t/ml-aggregation-and-fields/107474/3 "2017-11-15T03:58:43Z")
Ah got it, thanks! ---
**Author:** ![mathurin68](https://avatars.discourse-cdn.com/v4/letter/m/6bbea6/32.png) [@mathurin68](https://discuss.elastic.co/u/mathurin68)\ **Post date:** [November 22, 2017, 11:48pm UTC](https://discuss.elastic.co/t/ml-aggregation-and-fields/107474/4 "2017-11-22T23:48:01Z")
Alright I'm trying this but... I want to get the 'rare' of something, I'm not sure what ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/5/85c86ee5cee1d9bf122694535b33f9b0c14b8a08.png) The categorization filter is supposed to take this from the windows command line - "C:\frompath\frompath\Pulse.exe" -tray to Pulse.exe" -tray I could have this totally wrong... I'm trying to detect items like this on the win cmd or ps cmd START cmd.exe /c type test \> c:\temp\backdoor.bat Appreciate any input...thanks! ---
**Author:** ![mathurin68](https://avatars.discourse-cdn.com/v4/letter/m/6bbea6/32.png) [@mathurin68](https://discuss.elastic.co/u/mathurin68)\ **Post date:** [November 23, 2017, 4:04am UTC](https://discuss.elastic.co/t/ml-aggregation-and-fields/107474/5 "2017-11-23T04:04:49Z")
Hmm, was just told by someone else that this isn't what I want to use, need to use 'rare' function. Alright, back to the drawing board! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 21, 2017, 4:05am UTC](https://discuss.elastic.co/t/ml-aggregation-and-fields/107474/6 "2017-12-21T04:05:44Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.