Skip to content

Commit cc6d6ca

Browse files
authored
[DOCS] Small fixes in rule configuration page (#32516)
1 parent 09e38f2 commit cc6d6ca

File tree

1 file changed

+11
-9
lines changed

1 file changed

+11
-9
lines changed

x-pack/docs/en/ml/detector-custom-rules.asciidoc

+11-9
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ Let us see how those can be configured by examples.
1616

1717
==== Specifying rule scope
1818

19-
Let us assume we are configuring a job in order to DNS data exfiltration.
19+
Let us assume we are configuring a job in order to detect DNS data exfiltration.
2020
Our data contain fields "subdomain" and "highest_registered_domain".
2121
We can use a detector that looks like `high_info_content(subdomain) over highest_registered_domain`.
2222
If we run such a job it is possible that we discover a lot of anomalies on
@@ -25,8 +25,8 @@ are not interested in such anomalies. Ideally, we could instruct the detector to
2525
skip results for domains that we consider safe. Using a rule with a scope allows
2626
us to achieve this.
2727

28-
First, we need to create a list with our safe domains. Those lists are called
29-
`filters` in {ml}. Filters can be shared across jobs.
28+
First, we need to create a list of our safe domains. Those lists are called
29+
_filters_ in {ml}. Filters can be shared across jobs.
3030

3131
We create our filter using the {ref}/ml-put-filter.html[put filter API]:
3232

@@ -40,8 +40,8 @@ PUT _xpack/ml/filters/safe_domains
4040
----------------------------------
4141
// CONSOLE
4242

43-
Now, we can create our job specifying a scope that uses the filter for the
44-
`highest_registered_domain` field:
43+
Now, we can create our job specifying a scope that uses the `safe_domains`
44+
filter for the `highest_registered_domain` field:
4545

4646
[source,js]
4747
----------------------------------
@@ -85,7 +85,9 @@ POST _xpack/ml/filters/safe_domains/_update
8585
// CONSOLE
8686
// TEST[setup:ml_filter_safe_domains]
8787

88-
Note that we can provide scope for any of the partition/over/by fields.
88+
Note that we can use any of the `partition_field_name`, `over_field_name`, or
89+
`by_field_name` fields in the `scope`.
90+
8991
In the following example we scope multiple fields:
9092

9193
[source,js]
@@ -210,9 +212,9 @@ Rules only affect results created after the rules were applied.
210212
Let us imagine that we have configured a job and it has been running
211213
for some time. After observing its results we decide that we can employ
212214
rules in order to get rid of some uninteresting results. We can use
213-
the update-job API to do so. However, the rule we added will only be in effect
214-
for any results created from the moment we added the rule onwards. Past results
215-
will remain unaffected.
215+
the {ref}/ml-update-job.html[update job API] to do so. However, the rule we
216+
added will only be in effect for any results created from the moment we added
217+
the rule onwards. Past results will remain unaffected.
216218

217219
==== Using rules VS filtering data
218220

0 commit comments

Comments
 (0)