Multiple Machine Learning Alerts by Influencer Field failing Unknown column [job_id]

Elastic Security SIEM
1

Hello,

I am seeing the prebuilt rule Multiple Machine Learning Alerts by Influencer Field fail with:

verification_exception
Unknown column [job_id]
Unknown column [influencers.influencer_field_name]
Unknown column [influencers.influencer_field_values]

The ML rules themselves are working and generating Security alerts.

Example ML alert _source contains:

"job_id": "auth_rare_hour_for_a_user",
"influencers": [
  {
    "influencer_field_name": "source.ip",
    "influencer_field_values": [
      "10.x.x.x"
    ]
  }
]

However:

GET .alerts-security*/_field_caps?fields=job_id,influencers.influencer_field_name,influencers.influencer_field_values

returns:

"fields": {}

And:

GET .alerts-security*/_mapping/field/job_id

shows no mapping for the field.

So the fields exist in _source, but are not mapped/indexed, while the prebuilt ES|QL rule directly references them.

The failing query includes:

COUNT_DISTINCT(job_id)
VALUES(influencers.influencer_field_values)
VALUES(influencers.influencer_field_name)

This looks like a mismatch between the Security ML alert schema and the prebuilt higher-order rule.

Is this a known issue, or is there an expected mapping/template that should contain these ML fields?

Best regards,

Willem D'Haese