# ProblemChild Getting Started question
**URL:** https://discuss.elastic.co/t/problemchild-getting-started-question/273338
**Category:** Elasticsearch
**Tags:** elastic-stack-machine-learning
**Created:** [May 18, 2021, 7:17pm UTC](https://discuss.elastic.co/t/problemchild-getting-started-question/273338 "2021-05-18T19:17:00Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@willemdh](https://discuss.elastic.co/u/willemdh)
#### Post date: [May 18, 2021, 7:17pm UTC](https://discuss.elastic.co/t/problemchild-getting-started-question/273338/1 "2021-05-18T19:17:01Z")
Hello,
Just read through [ProblemChild: Detecting living-off-the-land attacks using the Elastic Stack | Elastic Blog](https://www.elastic.co/blog/problemchild-detecting-living-off-the-land-attacks)
which all seems super interesting.
So.. Forgive me for my noobish questions.. But I was wondering how exactly I should start building this on my own Elastic stack.
I guess I need to store the scripts first with [How to write scripts | Elasticsearch Guide [7.12] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-scripting-using.html#script-stored-scripts) ?
As I'm using Winlogbeat, am I supposed to use this pipeline [examples/problemchild\_features.json at master · elastic/examples · GitHub](https://github.com/elastic/examples/blob/master/Machine%20Learning/ProblemChild/problemchild_features.json)
while ingesting winlogbeat data so my winlogbeat data contains the correct features fields?
And then do data fram analytics classification on the resulting winlogbeat index?
Best regards,
Willem
---
### Author:  [@Apoorva\_Joshi](https://discuss.elastic.co/u/Apoorva_Joshi)
#### Post date: [May 18, 2021, 9:51pm UTC](https://discuss.elastic.co/t/problemchild-getting-started-question/273338/2 "2021-05-18T21:51:32Z")
Hello @willemdh!
Thanks for reaching out. Hope this answers your questions:
Yes you'll first need to set all the scripts ([ngram\_extractor](https://github.com/elastic/examples/blob/master/Machine%20Learning/ProblemChild/ngram_extractor.json), [normalize\_ppath](https://github.com/elastic/examples/blob/master/Machine%20Learning/ProblemChild/normalize_ppath.json), [features\_winlogbeat](https://github.com/elastic/examples/blob/master/Machine%20Learning/ProblemChild/features_winlogbeat.json)) in your cluster state.
You will then set [this](https://github.com/elastic/examples/blob/master/Machine%20Learning/ProblemChild/problemchild_features.json) ingest pipeline.
Once you've set those, I would suggest using the ingest pipeline to re-index your raw winlogbeat data into another index and using that index to run your Data Frame Analytics jobs. Hope this helps!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 15, 2021, 9:52pm UTC](https://discuss.elastic.co/t/problemchild-getting-started-question/273338/3 "2021-06-15T21:52:24Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.