Skip to content

[Security] [Serverless: Mar 31] Update prebuilt ML jobs documentation with EA changes#5348

Merged
natasha-moore-elastic merged 18 commits intomainfrom
update-ml-siem-docs-with-euid-changes
Apr 2, 2026
Merged

[Security] [Serverless: Mar 31] Update prebuilt ML jobs documentation with EA changes#5348
natasha-moore-elastic merged 18 commits intomainfrom
update-ml-siem-docs-with-euid-changes

Conversation

@sodhikirti07
Copy link
Copy Markdown
Contributor

@sodhikirti07 sodhikirti07 commented Mar 3, 2026 •
edited
Loading

Summary

  • Updated the ML jobs ID, description to reflect the changes we made for the new Entity Analytics (EA) in our ML jobs.
  • Added Privileged Access Detection under Security Integrations

Relates to:

These changes are staged for 9.4 release.

Generative AI disclosure

  1. Did you use a generative AI (GenAI) tool to assist in creating this contribution?
  • Yes
  • No

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 3, 2026 •
edited
Loading

Vale Linting Results

Summary: 92 suggestions found

💡 Suggestions (92)
File Line Rule Message
reference/machine-learning/ootb-ml-jobs-siem.md 115 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 130 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 149 Elastic.Wordiness Consider using 'also' instead of 'In addition'.
reference/machine-learning/ootb-ml-jobs-siem.md 164 Elastic.Wordiness Consider using 'also' instead of 'In addition'.
reference/machine-learning/ootb-ml-jobs-siem.md 217 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 217 Elastic.Wordiness Consider using 'to' instead of 'as a means of'.
reference/machine-learning/ootb-ml-jobs-siem.md 232 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 232 Elastic.Wordiness Consider using 'to' instead of 'as a means of'.
reference/machine-learning/ootb-ml-jobs-siem.md 327 Elastic.WordChoice Consider using 'efficiently' instead of 'simply', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 340 Elastic.WordChoice Consider using 'efficiently' instead of 'simply', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 451 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 451 Elastic.WordChoice Consider using 'efficiently' instead of 'simply', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 460 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 460 Elastic.WordChoice Consider using 'efficiently' instead of 'simply', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 469 Elastic.WordChoice Consider using 'atypical, not typical' instead of 'abnormal', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 478 Elastic.WordChoice Consider using 'atypical, not typical' instead of 'abnormal', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 841 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 856 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 875 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 875 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 890 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 890 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 909 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 909 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 924 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 924 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 943 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 943 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 958 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 958 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 977 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 977 Elastic.Wordiness Consider using 'to' instead of 'in order to'.
reference/machine-learning/ootb-ml-jobs-siem.md 992 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 992 Elastic.Wordiness Consider using 'to' instead of 'in order to'.
reference/machine-learning/ootb-ml-jobs-siem.md 1011 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1011 Elastic.Wordiness Consider using 'to' instead of 'in order to'.
reference/machine-learning/ootb-ml-jobs-siem.md 1026 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1026 Elastic.Wordiness Consider using 'to' instead of 'in order to'.
reference/machine-learning/ootb-ml-jobs-siem.md 1113 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1113 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1128 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1128 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1147 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1147 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1162 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1162 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1181 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1181 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1196 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1196 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1215 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1230 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1254 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1254 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1254 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1265 Elastic.Wordiness Consider using 'to' instead of 'in order to'.
reference/machine-learning/ootb-ml-jobs-siem.md 1265 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1265 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1276 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1276 Elastic.Semicolons Use semicolons judiciously.
reference/machine-learning/ootb-ml-jobs-siem.md 1276 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1287 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1287 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1287 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1488 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1503 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1556 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1556 Elastic.WordChoice Consider using 'run, start' instead of 'execute', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1571 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1571 Elastic.WordChoice Consider using 'run, start' instead of 'execute', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1590 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1605 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1624 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1639 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1658 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1673 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1692 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1707 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1726 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1726 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1741 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1741 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1760 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1760 Elastic.Wordiness Consider using 'to' instead of 'in order to'.
reference/machine-learning/ootb-ml-jobs-siem.md 1775 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1775 Elastic.Wordiness Consider using 'to' instead of 'in order to'.
reference/machine-learning/ootb-ml-jobs-siem.md 1794 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1794 Elastic.Wordiness Consider using 'to' instead of 'in order to'.
reference/machine-learning/ootb-ml-jobs-siem.md 1809 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1809 Elastic.Wordiness Consider using 'to' instead of 'in order to'.
reference/machine-learning/ootb-ml-jobs-siem.md 1896 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
reference/machine-learning/ootb-ml-jobs-siem.md 1911 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 3, 2026 •
edited
Loading

🔍 Preview links for changed docs

⏳ Building and deploying preview... View progress

This comment will be updated with preview links when the build is complete.

@sodhikirti07 sodhikirti07 changed the title Update prebuilt ML jobs documentation with EUID changes Update prebuilt ML jobs documentation with EA changes Mar 9, 2026
susan-shu-c
susan-shu-c reviewed Mar 10, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@susan-shu-c susan-shu-c left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the changes, Kirti!

reference/machine-learning/ootb-ml-jobs-siem.md Outdated
@@ -17,6 +17,12 @@ products:

These {{anomaly-jobs}} automatically detect file system and network anomalies on your hosts. They appear in the **Anomaly Detection** interface of the {{security-app}} in {{kib}} when you have data that matches their configuration. For more information, refer to [Anomaly detection with machine learning](/solutions/security/advanced-entity-analytics/anomaly-detection.md).

::::{note}
With version 9.4, Elastic Stack introduces support for Entity Analytics (EA), adding new fields for proper entity resolution. The machine learning jobs created from this version onward are designed to leverage these fields.
Copy link
Copy Markdown
Member

@susan-shu-c susan-shu-c Mar 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
With version 9.4, Elastic Stack introduces support for Entity Analytics (EA), adding new fields for proper entity resolution. The machine learning jobs created from this version onward are designed to leverage these fields.
With version 9.4, the Elastic Stack introduces support for Entity Analytics (EA), adding new fields for proper entity resolution. The machine learning jobs created from this version onward are designed to leverage these fields.

reference/machine-learning/ootb-ml-jobs-siem.md Outdated
| gcp_audit_high_distinct_count_error_message_ea | Looks for a spike in the rate of an action where the event outcome is a failure. Spikes might indicate an impending service failure but could also be byproducts of attempted or successful persistence, privilege escalation, defense evasion, discovery, lateral movement, or collection activity by a threat actor. | [code](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/security_gcp_audit/ml/gcp_audit_high_distinct_count_error_message_ea.json)| [code](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/security_gcp_audit/ml/datafeed_gcp_audit_high_distinct_count_error_message_ea.json)| [GCP Audit](https://www.elastic.co/docs/reference/integrations/gcp/audit) |
| gcp_audit_rare_error_code_ea | Looks for unusual errors. Rare and unusual errors might indicate an impending service failure but they can also be byproducts of attempted or successful persistence, privilege escalation, defense evasion, discovery, lateral movement, or collection activity by a threat actor. | [code](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/security_gcp_audit/ml/gcp_audit_rare_error_code_ea.json)| [code](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/security_gcp_audit/ml/datafeed_gcp_audit_rare_error_code_ea.json)| [GCP Audit](https://www.elastic.co/docs/reference/integrations/gcp/audit) |
| gcp_audit_rare_method_for_a_city_ea | Looks for GCP actions that, while not inherently suspicious or atypical, are sourcing from a geolocation (city) that is unexpected. This can be the result of compromised credentials or keys. | [code](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/security_gcp_audit/ml/gcp_audit_rare_method_for_a_city_ea.json)| [code](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/security_gcp_audit/ml/datafeed_gcp_audit_rare_method_for_a_city_ea.json)| [GCP Audit](https://www.elastic.co/docs/reference/integrations/gcp/audit) |
| gcp_audit_rare_method_for_a_country_ea | Looks for GCP actions calls that, while not inherently suspicious or aytpical, are sourcing from a geolocation (country) that is unexpected. This can be the result of compromised credentials or keys. | [code](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/security_gcp_audit/ml/gcp_audit_rare_method_for_a_country_ea.json)| [code](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/security_gcp_audit/ml/datafeed_gcp_audit_rare_method_for_a_country_ea.json)| [GCP Audit](https://www.elastic.co/docs/reference/integrations/gcp/audit) |
Copy link
Copy Markdown
Member

@susan-shu-c susan-shu-c Mar 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
| gcp_audit_rare_method_for_a_country_ea | Looks for GCP actions calls that, while not inherently suspicious or aytpical, are sourcing from a geolocation (country) that is unexpected. This can be the result of compromised credentials or keys. | [code](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/security_gcp_audit/ml/gcp_audit_rare_method_for_a_country_ea.json)| [code](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/security_gcp_audit/ml/datafeed_gcp_audit_rare_method_for_a_country_ea.json)| [GCP Audit](https://www.elastic.co/docs/reference/integrations/gcp/audit) |
| gcp_audit_rare_method_for_a_country_ea | Looks for GCP actions calls that, while not inherently suspicious or atypical, are sourcing from a geolocation (country) that is unexpected. This can be the result of compromised credentials or keys. | [code](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/security_gcp_audit/ml/gcp_audit_rare_method_for_a_country_ea.json)| [code](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/security_gcp_audit/ml/datafeed_gcp_audit_rare_method_for_a_country_ea.json)| [GCP Audit](https://www.elastic.co/docs/reference/integrations/gcp/audit) |

Copy link
Copy Markdown
Member

@susan-shu-c susan-shu-c Mar 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If this is a typo from the job, let's take the opportunity to update the jobs as well

reference/machine-learning/ootb-ml-jobs-siem.md Outdated
| lmd_high_mean_rdp_session_duration_ea | Detects unusually high mean of RDP session duration. | [{{elastic-defend}}](https://www.elastic.co/docs/reference/integrations/endpoint) | windows |
| lmd_high_var_rdp_session_duration_ea | Detects unusually high variance in RDP session duration. | [{{elastic-defend}}](https://www.elastic.co/docs/reference/integrations/endpoint) | windows |
| lmd_high_sum_rdp_number_of_processes_ea | Detects unusually high number of processes started in a single RDP session. | [{{elastic-defend}}](https://www.elastic.co/docs/reference/integrations/endpoint) | windows |
| lmd_unusual_time_weekday_rdp_session_start_ea | Detects an RDP session started at an usual time or weekday. | [{{elastic-defend}}](https://www.elastic.co/docs/reference/integrations/endpoint) | windows |
Copy link
Copy Markdown
Member

@susan-shu-c susan-shu-c Mar 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
| lmd_unusual_time_weekday_rdp_session_start_ea | Detects an RDP session started at an usual time or weekday. | [{{elastic-defend}}](https://www.elastic.co/docs/reference/integrations/endpoint) | windows |
| lmd_unusual_time_weekday_rdp_session_start_ea | Detects an RDP session started at an unusual time or weekday. | [{{elastic-defend}}](https://www.elastic.co/docs/reference/integrations/endpoint) | windows |

Copy link
Copy Markdown
Member

@susan-shu-c susan-shu-c Mar 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If this is a typo from the job, let's take the opportunity to update the jobs as well

@sodhikirti07 sodhikirti07 marked this pull request as ready for review March 18, 2026 13:59
@sodhikirti07 sodhikirti07 requested a review from a team as a code owner March 18, 2026 13:59
@sodhikirti07
Copy link
Copy Markdown
Contributor Author

sodhikirti07 commented Mar 18, 2026

@elastic/docs Could you take a look at the changes?

jmcarlock
jmcarlock reviewed Mar 18, 2026
View reviewed changes
reference/machine-learning/ootb-ml-jobs-siem.md Outdated
| rare_error_code | Looks for unusual errors. Rare and unusual errors may simply indicate an impending service failure but they can also be byproducts of attempted or successful persistence, privilege escalation, defense evasion, discovery, lateral movement, or collection activity by a threat actor. | [code](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/security_cloudtrail/ml/rare_error_code.json)| [code](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/security_cloudtrail/ml/datafeed_rare_error_code.json)| [AWS](https://www.elastic.co/docs/reference/integrations/aws/cloudtrail) |
| rare_method_for_a_city | Looks for AWS API calls that, while not inherently suspicious or abnormal, are sourcing from a geolocation (city) that is unusual. This can be the result of compromised credentials or keys. | [code](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/security_cloudtrail/ml/rare_method_for_a_city.json)| [code](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/security_cloudtrail/ml/datafeed_rare_method_for_a_city.json)| [AWS](https://www.elastic.co/docs/reference/integrations/aws/cloudtrail) |
| rare_method_for_a_country | Looks for AWS API calls that, while not inherently suspicious or abnormal, are sourcing from a geolocation (country) that is unusual. This can be the result of compromised credentials or keys. | [code](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/security_cloudtrail/ml/rare_method_for_a_country.json)| [code](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/security_cloudtrail/ml/datafeed_rare_method_for_a_country.json)| [AWS](https://www.elastic.co/docs/reference/integrations/aws/cloudtrail) |
| rare_method_for_a_username_ea | Looks for AWS API calls that, while not inherently suspicious or atypical, are sourcing from a user context that does not normally call the method. This can be the result of compromised credentials or keys as someone uses a valid account to persist, move laterally, or exfil data. | [code](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/security_cloudtrail/ml/rare_method_for_a_username_ea.json)| [code](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/security_cloudtrail/ml/datafeed_rare_method_for_a_username_ea.json)| [AWS](https://www.elastic.co/docs/reference/integrations/aws/cloudtrail) |


## Security: GCP Audit logs [security-gcp-audit]
Copy link
Copy Markdown
Contributor

@jmcarlock jmcarlock Mar 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should make a note that these jobs now require the GCP audit integration version 2.47.2.

@natasha-moore-elastic natasha-moore-elastic self-assigned this Mar 23, 2026
@natasha-moore-elastic
Copy link
Copy Markdown
Contributor

natasha-moore-elastic commented Mar 23, 2026 •
edited
Loading

This commit updates the PR for structure and doc conventions:

  • Replaces job tables with definition lists inside applies-switch blocks, so each version branch (e.g. 9.4+ vs 9.0–9.3) lists jobs in a consistent, readable form. Some columns in the tables spanned multiple lines and were very difficult to read.
  • Uses applies-switch blocks to differentiate the content for 9.4+ / serverless _ea jobs vs 9.0–9.3 jobs
  • Adds applies_to badge to the Entity Analytics callout, tweaks wording and uses shared subs.
  • Uses integration-docs:// and beats:// instead of https://www.elastic.co/docs/reference/ for cross-linking to supported integrations
  • Clarifies that net new content (Privileged Access Detection jobs) is applicable to 9.4+ / serverless only.

@natasha-moore-elastic natasha-moore-elastic mentioned this pull request Mar 24, 2026
Closed
@natasha-moore-elastic natasha-moore-elastic changed the title Update prebuilt ML jobs documentation with EA changes [Security] [Serverless: Mar 31] Update prebuilt ML jobs documentation with EA changes Mar 24, 2026
@natasha-moore-elastic natasha-moore-elastic linked an issue Mar 24, 2026 that may be closed by this pull request
[Security] Update prebuilt ML jobs documentation with EA changes #5605
Closed
@sodhikirti07
Copy link
Copy Markdown
Contributor Author

sodhikirti07 commented Mar 25, 2026

@natasha-moore-elastic This PR is ready to merge.

@natasha-moore-elastic
Copy link
Copy Markdown
Contributor

natasha-moore-elastic commented Mar 25, 2026 •
edited
Loading

@natasha-moore-elastic This PR is ready to merge.

Thanks @sodhikirti07, I will merge it when the dev changes are live in serverless (next week's release)

@natasha-moore-elastic natasha-moore-elastic merged commit 9223f96 into main Apr 2, 2026
7 checks passed
@natasha-moore-elastic natasha-moore-elastic deleted the update-ml-siem-docs-with-euid-changes branch April 2, 2026 07:29
@marciw marciw mentioned this pull request Apr 9, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jmcarlock jmcarlock jmcarlock approved these changes

@susan-shu-c susan-shu-c susan-shu-c approved these changes

@natasha-moore-elastic natasha-moore-elastic natasha-moore-elastic approved these changes

Assignees

@natasha-moore-elastic natasha-moore-elastic

Labels

9.4

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Security] Update prebuilt ML jobs documentation with EA changes

4 participants

@sodhikirti07 @natasha-moore-elastic @jmcarlock @susan-shu-c