Decline in host-based traffic

Last updated 6 months ago on 2025-02-18

Created 6 months ago on 2025-02-18

About

A machine learning job has detected a sudden drop in host based traffic. This can be due to a range of security issues, such as a compromised system, a failed service, or a network misconfiguration.

Tags: Use Case: Threat DetectionRule Type: MLRule Type: Machine Learning
Severity: low
Risk Score: 21
False Positive Examples: Legitimate causes such as system maintenance, server shutdowns, or temporary network outages may trigger this alert.
License: Elastic License v2(opens in a new tab or window)

Definition

Rule Type: Machine Learning
Integration Pack: Prebuilt Security Detection Rules
Related Integrations: endpoint(opens in a new tab or window)
Query

Install detection rules in Elastic Security

Detect Decline in host-based traffic in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(opens in a new tab or window).