Elastic Security Detection Rules

Multiple Machine Learning Alerts by Influencer Field

Last updated 9 days ago on 2026-02-02
Created 9 days ago on 2026-02-02

About

This rule uses alerts data to determine when multiple unique machine learning jobs involving the same influencer field are triggered. Analysts can use this to prioritize triage and response machine learning alerts.
Tags
Use Case: Threat DetectionRule Type: Higher-Order RuleRule Type: Machine LearningLanguage: esql
Severity
high
Risk Score
73
License
Elastic License v2(external, opens in a new tab or window)

Definition

Integration Pack
Prebuilt Security Detection Rules
Related Integrations

(external, opens in a new tab or window)

Query
text code block:
from .alerts-security.*
| where kibana.alert.rule.type == "machine_learning"
| stats Esql.count_distinct_job_id = COUNT_DISTINCT(job_id),
        Esql.job_id_values = VALUES(job_id),
        Esql.rule_name_values = VALUES(kibana.alert.rule.name),
        Esql.influencer_field_values = VALUES(influencers.influencer_field_values),
        Esql.influencer_field_name = VALUES(influencers.influencer_field_name) by influencers.influencer_field_values, process.name, host.name
| where Esql.count_distinct_job_id >= 3 and not influencers.influencer_field_values in ("root", "SYSTEM")
| KEEP influencers.influencer_field_values, process.name, host.name, Esql.*

Install detection rules in Elastic Security

Detect Multiple Machine Learning Alerts by Influencer Field in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).