Skip to content

Commit cf7953b

Browse files
droberts195droberts195
authored
[ML] Add allow_lazy_open and max_empty_searches to SIEM jobs (#48238) (#48372)
This change augments the SIEM jobs and datafeeds that were added in #47848 with the allow_lazy_open and max_empty_searches options that were added in elastic/elasticsearch#47726 and elastic/elasticsearch#47922 respectively.
1 parent 4cd02c2 commit cf7953b

File tree

48 files changed

+53
-5
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

48 files changed

+53
-5
lines changed

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_linux_anomalous_network_activity_ecs.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
"indices": [
44
"INDEX_PATTERN_NAME"
55
],
6+
"max_empty_searches": 10,
67
"query": {
78
"bool": {
89
"filter": [

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_linux_anomalous_network_port_activity_ecs.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
"indices": [
44
"INDEX_PATTERN_NAME"
55
],
6+
"max_empty_searches": 10,
67
"query": {
78
"bool": {
89
"filter": [
@@ -24,4 +25,4 @@
2425
]
2526
}
2627
}
27-
}
28+
}

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_linux_anomalous_network_service.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
"indices": [
44
"INDEX_PATTERN_NAME"
55
],
6+
"max_empty_searches": 10,
67
"query": {
78
"bool": {
89
"filter": [
@@ -23,4 +24,4 @@
2324
]
2425
}
2526
}
26-
}
27+
}

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_linux_anomalous_network_url_activity_ecs.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
"indices": [
44
"INDEX_PATTERN_NAME"
55
],
6+
"max_empty_searches": 10,
67
"query": {
78
"bool":{
89
"filter": [

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_linux_anomalous_process_all_hosts_ecs.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
"indices": [
44
"INDEX_PATTERN_NAME"
55
],
6+
"max_empty_searches": 10,
67
"query": {
78
"bool": {
89
"filter": [

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_linux_anomalous_user_name_ecs.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
"indices": [
44
"INDEX_PATTERN_NAME"
55
],
6+
"max_empty_searches": 10,
67
"query": {
78
"bool": {
89
"filter": [

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_rare_process_by_host_linux_ecs.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
"indexes": [
44
"INDEX_PATTERN_NAME"
55
],
6+
"max_empty_searches": 10,
67
"query": {
78
"bool": {
89
"filter": [

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_suspicious_login_activity_ecs.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
"indexes": [
44
"INDEX_PATTERN_NAME"
55
],
6+
"max_empty_searches": 10,
67
"query": {
78
"bool": {
89
"filter": {

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_anomalous_network_activity_ecs.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131
"destination.ip"
3232
]
3333
},
34+
"allow_lazy_open": true,
3435
"analysis_limits": {
3536
"model_memory_limit": "64mb"
3637
},

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_anomalous_network_port_activity_ecs.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
"destination.ip"
2323
]
2424
},
25+
"allow_lazy_open": true,
2526
"analysis_limits": {
2627
"model_memory_limit": "32mb"
2728
},

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_anomalous_network_service.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
"user.name"
2222
]
2323
},
24+
"allow_lazy_open": true,
2425
"analysis_limits": {
2526
"model_memory_limit": "128mb"
2627
},

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_anomalous_network_url_activity_ecs.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
"destination.port"
2222
]
2323
},
24+
"allow_lazy_open": true,
2425
"analysis_limits": {
2526
"model_memory_limit": "32mb"
2627
},

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_anomalous_process_all_hosts_ecs.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
"user.name"
2222
]
2323
},
24+
"allow_lazy_open": true,
2425
"analysis_limits": {
2526
"model_memory_limit": "512mb"
2627
},

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/linux_anomalous_user_name_ecs.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131
"user.name"
3232
]
3333
},
34+
"allow_lazy_open": true,
3435
"analysis_limits": {
3536
"model_memory_limit": "32mb"
3637
},

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/rare_process_by_host_linux_ecs.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
"user.name"
2323
]
2424
},
25+
"allow_lazy_open": true,
2526
"analysis_limits": {
2627
"model_memory_limit": "256mb"
2728
},

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/suspicious_login_activity_ecs.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
"source.ip"
2020
]
2121
},
22+
"allow_lazy_open": true,
2223
"analysis_limits": {
2324
"model_memory_limit": "256mb"
2425
},

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat_auth/ml/datafeed_suspicious_login_activity_ecs.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
"indexes": [
44
"INDEX_PATTERN_NAME"
55
],
6+
"max_empty_searches": 10,
67
"query": {
78
"bool": {
89
"filter": [

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat_auth/ml/suspicious_login_activity_ecs.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
"source.ip"
2222
]
2323
},
24+
"allow_lazy_open": true,
2425
"analysis_limits": {
2526
"model_memory_limit": "256mb"
2627
},

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_packetbeat/ml/datafeed_packetbeat_dns_tunneling.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
"indices": [
44
"INDEX_PATTERN_NAME"
55
],
6+
"max_empty_searches": 10,
67
"query": {
78
"bool": {
89
"filter": [

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_packetbeat/ml/datafeed_packetbeat_rare_dns_question.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
"indices": [
44
"INDEX_PATTERN_NAME"
55
],
6+
"max_empty_searches": 10,
67
"query": {
78
"bool": {
89
"filter": [

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_packetbeat/ml/datafeed_packetbeat_rare_server_domain.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
"indices": [
44
"INDEX_PATTERN_NAME"
55
],
6+
"max_empty_searches": 10,
67
"query": {
78
"bool": {
89
"filter": [

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_packetbeat/ml/datafeed_packetbeat_rare_urls.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
"indices": [
44
"INDEX_PATTERN_NAME"
55
],
6+
"max_empty_searches": 10,
67
"query": {
78
"bool": {
89
"filter": [
@@ -14,4 +15,4 @@
1415
]
1516
}
1617
}
17-
}
18+
}

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_packetbeat/ml/datafeed_packetbeat_rare_user_agent.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
"indices": [
44
"INDEX_PATTERN_NAME"
55
],
6+
"max_empty_searches": 10,
67
"query": {
78
"bool": {
89
"filter": [
@@ -14,4 +15,4 @@
1415
]
1516
}
1617
}
17-
}
18+
}

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_packetbeat/ml/packetbeat_dns_tunneling.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@
3636
"dns.question.etld_plus_one"
3737
]
3838
},
39+
"allow_lazy_open": true,
3940
"analysis_limits": {
4041
"model_memory_limit": "256mb"
4142
},

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_packetbeat/ml/packetbeat_rare_dns_question.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
"host.name"
2020
]
2121
},
22+
"allow_lazy_open": true,
2223
"analysis_limits": {
2324
"model_memory_limit": "256mb"
2425
},

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_packetbeat/ml/packetbeat_rare_server_domain.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
"source.ip"
2222
]
2323
},
24+
"allow_lazy_open": true,
2425
"analysis_limits": {
2526
"model_memory_limit": "256mb"
2627
},

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_packetbeat/ml/packetbeat_rare_urls.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
"destination.ip"
2121
]
2222
},
23+
"allow_lazy_open": true,
2324
"analysis_limits": {
2425
"model_memory_limit": "256mb"
2526
},

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_packetbeat/ml/packetbeat_rare_user_agent.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
"destination.ip"
2121
]
2222
},
23+
"allow_lazy_open": true,
2324
"analysis_limits": {
2425
"model_memory_limit": "256mb"
2526
},

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat/ml/datafeed_rare_process_by_host_windows_ecs.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
"indexes": [
44
"INDEX_PATTERN_NAME"
55
],
6+
"max_empty_searches": 10,
67
"query": {
78
"bool": {
89
"filter": [

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat/ml/datafeed_windows_anomalous_network_activity_ecs.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
"indices": [
44
"INDEX_PATTERN_NAME"
55
],
6+
"max_empty_searches": 10,
67
"query": {
78
"bool": {
89
"filter": [

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat/ml/datafeed_windows_anomalous_path_activity_ecs.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
"indices": [
44
"INDEX_PATTERN_NAME"
55
],
6+
"max_empty_searches": 10,
67
"query": {
78
"bool": {
89
"filter": [

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat/ml/datafeed_windows_anomalous_process_all_hosts_ecs.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
"indices": [
44
"INDEX_PATTERN_NAME"
55
],
6+
"max_empty_searches": 10,
67
"query": {
78
"bool": {
89
"filter": [

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat/ml/datafeed_windows_anomalous_process_creation.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
"indices": [
44
"INDEX_PATTERN_NAME"
55
],
6+
"max_empty_searches": 10,
67
"query": {
78
"bool": {
89
"filter": [

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat/ml/datafeed_windows_anomalous_script.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
"indices": [
44
"INDEX_PATTERN_NAME"
55
],
6+
"max_empty_searches": 10,
67
"query": {
78
"bool": {
89
"filter": [

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat/ml/datafeed_windows_anomalous_service.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
"indices": [
44
"INDEX_PATTERN_NAME"
55
],
6+
"max_empty_searches": 10,
67
"query": {
78
"bool": {
89
"filter": [

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat/ml/datafeed_windows_anomalous_user_name_ecs.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
"indices": [
44
"INDEX_PATTERN_NAME"
55
],
6+
"max_empty_searches": 10,
67
"query": {
78
"bool": {
89
"filter": [

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat/ml/datafeed_windows_rare_user_runas_event.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
"indices": [
44
"INDEX_PATTERN_NAME"
55
],
6+
"max_empty_searches": 10,
67
"query": {
78
"bool": {
89
"filter": [
@@ -11,4 +12,4 @@
1112
]
1213
}
1314
}
14-
}
15+
}

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat/ml/rare_process_by_host_windows_ecs.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
"user.name"
2323
]
2424
},
25+
"allow_lazy_open": true,
2526
"analysis_limits": {
2627
"model_memory_limit": "256mb"
2728
},

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat/ml/windows_anomalous_network_activity_ecs.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131
"destination.ip"
3232
]
3333
},
34+
"allow_lazy_open": true,
3435
"analysis_limits": {
3536
"model_memory_limit": "64mb"
3637
},

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat/ml/windows_anomalous_path_activity_ecs.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
"user.name"
2222
]
2323
},
24+
"allow_lazy_open": true,
2425
"analysis_limits": {
2526
"model_memory_limit": "256mb"
2627
},

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat/ml/windows_anomalous_process_all_hosts_ecs.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@
3030
"user.name"
3131
]
3232
},
33+
"allow_lazy_open": true,
3334
"analysis_limits": {
3435
"model_memory_limit": "256mb"
3536
},

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat/ml/windows_anomalous_process_creation.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
"user.name"
2323
]
2424
},
25+
"allow_lazy_open": true,
2526
"analysis_limits": {
2627
"model_memory_limit": "256mb"
2728
},

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat/ml/windows_anomalous_script.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
"winlog.event_data.Path"
2222
]
2323
},
24+
"allow_lazy_open": true,
2425
"analysis_limits": {
2526
"model_memory_limit": "256mb"
2627
},

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat/ml/windows_anomalous_service.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
"winlog.event_data.ServiceName"
2121
]
2222
},
23+
"allow_lazy_open": true,
2324
"analysis_limits": {
2425
"model_memory_limit": "256mb"
2526
},

‎x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat/ml/windows_anomalous_user_name_ecs.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
"user.name"
2222
]
2323
},
24+
"allow_lazy_open": true,
2425
"analysis_limits": {
2526
"model_memory_limit": "256mb"
2627
},

0 commit comments

Comments
 (0)