ML Unsupervised question

[alex_su]

Hi, as i know es provide ml to detect unusual event, like "Unusual Windows Username" and another exapmle is " Unusual Hour for a User to Logon".

I have question about unusual meaning as belows.

1. how to build this ml ? like one host one model? or if i have 100 host event log data, we only need one model can handle it?

[Sergi_Massaneda_Dona (Sergi Massaneda)]

Hello. It is hard to tell based on the question. but we have a couple of blogs that explain the "rare" function in machine learning:

Using Elastic machine learning rare analysis to hunt for the unusual

Detecting rare and unusual processes with OOTB machine learning

Hope this helps

[shuchang]

We have some pre-built jobs that look for rarities in username over a single host:

Auth rare hour for user: Prebuilt job reference | Elastic Security Solution [8.5] | Elastic

Unusual Windows username: Unusual Windows Username | Elastic Security Solution [8.5] | Elastic

However it might depend on your situation specifically about your 100 host event log data.