# There seems to be a bug in 7.10.2's builtin ml job windows\_rare\_user\_type10\_remote\_login

**URL:** <https://discuss.elastic.co/t/there-seems-to-be-a-bug-in-7-10-2s-builtin-ml-job-windows-rare-user-type10-remote-login/264612>\
**Category:** Elastic Security\
**Tags:** elastic-stack-machine-learning\
**Created:** [February 17, 2021, 8:20pm UTC](https://discuss.elastic.co/t/there-seems-to-be-a-bug-in-7-10-2s-builtin-ml-job-windows-rare-user-type10-remote-login/264612 "2021-02-17T20:20:52Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Post date:** [February 17, 2021, 8:20pm UTC](https://discuss.elastic.co/t/there-seems-to-be-a-bug-in-7-10-2s-builtin-ml-job-windows-rare-user-type10-remote-login/264612/1 "2021-02-17T20:20:53Z")

</div>

Hello,

I noticed the windows\_rare\_user\_type10\_remote\_login ml job didn't produce a lot of data anymore.. To be sure there was nothing going on with an outdated builtin configuration, I re-added this ml job with the provided wizard.

But again the ml job did not produce any data. So I checked the query and noticed the event.type value in the query still points to an older value:

`{"bool":{"filter":[{"term":{"event.type":"authentication_success"}},{"term":{"winlog.event_data.LogonType":"10"}},{"term":{"agent.type":"winlogbeat"}}]}}`

`event.type` for type 10 RDP events is now `start`

![image](https://us1.discourse-cdn.com/elastic/original/3X/1/9/194e4c792fb2f8dd3051c28b1822c12c98a56225.png)

This might already be fixed in 7.11, but I don't have a 7.11 cluster yet (ad bug...), so I can't check.

Grtz

Willem

---

<div class="post-metadata">

**Author:** ![Craig\_Chamberlain](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/craig_chamberlain/32/70079_2.png) [@Craig\_Chamberlain](https://discuss.elastic.co/u/Craig_Chamberlain)\
**Post date:** [February 18, 2021, 7:05pm UTC](https://discuss.elastic.co/t/there-seems-to-be-a-bug-in-7-10-2s-builtin-ml-job-windows-rare-user-type10-remote-login/264612/2 "2021-02-18T19:05:20Z")

</div>

Thanks Willem for investigating and reporting this. You are correct, the event.type field value has changed. I will see about updating the query and I opened an issue here: [[Security Solution] Refactor RDP ML job for field changes · Issue #91910 · elastic/kibana · GitHub](https://github.com/elastic/kibana/issues/91910)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 18, 2021, 7:06pm UTC](https://discuss.elastic.co/t/there-seems-to-be-a-bug-in-7-10-2s-builtin-ml-job-windows-rare-user-type10-remote-login/264612/3 "2021-03-18T19:06:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.