windows_rare_metadata_user.json

{
    "job_type": "anomaly_detector",
    "description": "Security: Winlogbeat - Looks for anomalous access to the metadata service by an unusual user. The metadata service may be targeted in order to harvest credentials or user data scripts containing secrets.",
    "groups": [
      "security",
      "winlogbeat",
      "process"
    ],
    "analysis_config": {
      "bucket_span": "15m",
      "detectors": [
        {
          "detector_description": "rare by \"user.name\"",
          "function": "rare",
          "by_field_name": "user.name"
        }
      ],
      "influencers": [
        "host.name",
        "user.name"
      ]
    },
    "allow_lazy_open": true,
    "analysis_limits": {
      "model_memory_limit": "32mb"
    },
    "data_description": {
      "time_field": "@timestamp"
    },
    "custom_settings": {
      "created_by": "ml-module-siem-winlogbeat",
      "custom_urls": [
        {
          "url_name": "Host Details by user name",
          "url_value": "security/hosts/ml-hosts/$host.name$?_g=()&query=(query:'user.name%20:%20%22$user.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
        },
        {
          "url_name": "Hosts Overview by user name",
          "url_value": "security/hosts/ml-hosts?_g=()&query=(query:'user.name%20:%20%22$user.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
        }
      ]
    }
  }