1
1
[role="xpack"]
2
2
[[ml-configuring-detector-custom-rules]]
3
- === Customizing detectors with rules and filters
3
+ === Customizing detectors with custom rules
4
4
5
- <<ml-rules,Rules and filters >> enable you to change the behavior of anomaly
5
+ <<ml-rules,Custom rules >> enable you to change the behavior of anomaly
6
6
detectors based on domain-specific knowledge.
7
7
8
- Rules describe _when_ a detector should take a certain _action_ instead
8
+ Custom rules describe _when_ a detector should take a certain _action_ instead
9
9
of following its default behavior. To specify the _when_ a rule uses
10
10
a `scope` and `conditions`. You can think of `scope` as the categorical
11
11
specification of a rule, while `conditions` are the numerical part.
@@ -14,7 +14,7 @@ scope and conditions.
14
14
15
15
Let us see how those can be configured by examples.
16
16
17
- ==== Specifying rule scope
17
+ ==== Specifying custom rule scope
18
18
19
19
Let us assume we are configuring a job in order to detect DNS data exfiltration.
20
20
Our data contain fields "subdomain" and "highest_registered_domain".
@@ -127,7 +127,7 @@ PUT _xpack/ml/anomaly_detectors/scoping_multiple_fields
127
127
Such a detector will skip results when the values of all 3 scoped fields
128
128
are included in the referenced filters.
129
129
130
- ==== Specifying rule conditions
130
+ ==== Specifying custom rule conditions
131
131
132
132
Imagine a detector that looks for anomalies in CPU utilization.
133
133
Given a machine that is idle for long enough, small movement in CPU could
@@ -206,17 +206,17 @@ PUT _xpack/ml/anomaly_detectors/rule_with_range
206
206
----------------------------------
207
207
// CONSOLE
208
208
209
- ==== Rules in the life-cycle of a job
209
+ ==== Custom rules in the life-cycle of a job
210
210
211
- Rules only affect results created after the rules were applied.
211
+ Custom rules only affect results created after the rules were applied.
212
212
Let us imagine that we have configured a job and it has been running
213
213
for some time. After observing its results we decide that we can employ
214
214
rules in order to get rid of some uninteresting results. We can use
215
215
the {ref}/ml-update-job.html[update job API] to do so. However, the rule we
216
216
added will only be in effect for any results created from the moment we added
217
217
the rule onwards. Past results will remain unaffected.
218
218
219
- ==== Using rules VS filtering data
219
+ ==== Using custom rules VS filtering data
220
220
221
221
It might appear like using rules is just another way of filtering the data
222
222
that feeds into a job. For example, a rule that skips results when the
0 commit comments