packetbeat_rare_server_domain.json

{
  "job_type": "anomaly_detector",
  "description": "Security: Packetbeat - Looks for unusual HTTP or TLS destination domain activity that could indicate execution, persistence, command-and-control or data exfiltration activity.",
  "groups": [
    "security",
    "packetbeat",
    "web"
  ],
  "analysis_config": {
    "bucket_span": "15m",
    "detectors": [
      {
        "detector_description": "rare by \"server.domain\"",
        "function": "rare",
        "by_field_name": "server.domain"
      }
    ],
    "influencers": [
      "host.name",
      "destination.ip",
      "source.ip"
    ]
  },
  "allow_lazy_open": true,
  "analysis_limits": {
    "model_memory_limit": "256mb"
  },
  "data_description": {
    "time_field": "@timestamp"
  },
  "custom_settings": {
    "created_by": "ml-module-siem-packetbeat",
    "custom_urls": [
      {
        "url_name": "Host Details",
        "url_value": "security/hosts/ml-hosts/$host.name$?_g=()&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
      }
    ]
  }
}