auth_high_count_logon_events_for_a_source_ip.json

{
  "job_type": "anomaly_detector",
  "description": "Security: Authentication - looks for an unusually large spike in successful authentication events from a particular source IP address. This can be due to password spraying, user enumeration or brute force activity.",
  "groups": [
    "security",
    "authentication"
  ],
  "analysis_config": {
    "bucket_span": "15m",
    "detectors": [
      {
        "detector_description": "high count of auth events for a source IP",
        "function": "high_non_zero_count",
        "by_field_name": "source.ip",
        "detector_index": 0
      }
    ],
    "influencers": [
      "source.ip",
      "winlog.event_data.LogonType",
      "user.name"
    ],
    "model_prune_window": "30d"
  },
  "allow_lazy_open": true,
  "analysis_limits": {
    "model_memory_limit": "128mb"
  },
  "data_description": {
    "time_field": "@timestamp"
  },
  "custom_settings": {
    "created_by": "ml-module-security-auth"
  }
}