@@ -16,7 +16,7 @@ Let us see how those can be configured by examples.
16
16
17
17
==== Specifying rule scope
18
18
19
- Let us assume we are configuring a job in order to DNS data exfiltration.
19
+ Let us assume we are configuring a job in order to detect DNS data exfiltration.
20
20
Our data contain fields "subdomain" and "highest_registered_domain".
21
21
We can use a detector that looks like `high_info_content(subdomain) over highest_registered_domain`.
22
22
If we run such a job it is possible that we discover a lot of anomalies on
@@ -25,8 +25,8 @@ are not interested in such anomalies. Ideally, we could instruct the detector to
25
25
skip results for domains that we consider safe. Using a rule with a scope allows
26
26
us to achieve this.
27
27
28
- First, we need to create a list with our safe domains. Those lists are called
29
- `filters` in {ml}. Filters can be shared across jobs.
28
+ First, we need to create a list of our safe domains. Those lists are called
29
+ _filters_ in {ml}. Filters can be shared across jobs.
30
30
31
31
We create our filter using the {ref}/ml-put-filter.html[put filter API]:
32
32
@@ -40,8 +40,8 @@ PUT _xpack/ml/filters/safe_domains
40
40
----------------------------------
41
41
// CONSOLE
42
42
43
- Now, we can create our job specifying a scope that uses the filter for the
44
- `highest_registered_domain` field:
43
+ Now, we can create our job specifying a scope that uses the `safe_domains`
44
+ filter for the `highest_registered_domain` field:
45
45
46
46
[source,js]
47
47
----------------------------------
@@ -85,7 +85,9 @@ POST _xpack/ml/filters/safe_domains/_update
85
85
// CONSOLE
86
86
// TEST[setup:ml_filter_safe_domains]
87
87
88
- Note that we can provide scope for any of the partition/over/by fields.
88
+ Note that we can use any of the `partition_field_name`, `over_field_name`, or
89
+ `by_field_name` fields in the `scope`.
90
+
89
91
In the following example we scope multiple fields:
90
92
91
93
[source,js]
@@ -210,9 +212,9 @@ Rules only affect results created after the rules were applied.
210
212
Let us imagine that we have configured a job and it has been running
211
213
for some time. After observing its results we decide that we can employ
212
214
rules in order to get rid of some uninteresting results. We can use
213
- the update-job API to do so. However, the rule we added will only be in effect
214
- for any results created from the moment we added the rule onwards. Past results
215
- will remain unaffected.
215
+ the {ref}/ml- update-job.html[update job API] to do so. However, the rule we
216
+ added will only be in effect for any results created from the moment we added
217
+ the rule onwards. Past results will remain unaffected.
216
218
217
219
==== Using rules VS filtering data
218
220
0 commit comments