v3_windows_anomalous_network_activity.json

{
  "job_type": "anomaly_detector",
  "description": "Security: Windows - Looks for unusual processes using the network which could indicate command-and-control, lateral movement, persistence, or data exfiltration activity.",
  "groups": [
    "endpoint",
    "network",
    "security",
    "sysmon",
    "windows",
    "winlogbeat"
  ],
  "analysis_config": {
    "bucket_span": "15m",
    "detectors": [
      {
        "detector_description": "Detects rare process.name values.",
        "function": "rare",
        "by_field_name": "process.name",
        "detector_index": 0
      }
    ],
    "influencers": [
      "host.name",
      "process.name",
      "user.name",
      "destination.ip"
    ]
  },
  "allow_lazy_open": true,
  "analysis_limits": {
    "model_memory_limit": "64mb",
    "categorization_examples_limit": 4
  },
  "data_description": {
    "time_field": "@timestamp",
    "time_format": "epoch_ms"
  },
  "custom_settings": {
          "job_tags": {
      "euid": "8003",
      "maturity": "release",
      "author": "@randomuserid/Elastic",
      "version": "3",
      "updated_date": "5/16/2022"
  },
    "created_by": "ml-module-security-windows",
    "custom_urls": [
      {
        "url_name": "Host Details by process name",
        "url_value": "security/hosts/ml-hosts/$host.name$?_g=()&query=(query:'process.name%20:%20%22$process.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
      },
      {
        "url_name": "Host Details by user name",
        "url_value": "security/hosts/ml-hosts/$host.name$?_g=()&query=(query:'user.name%20:%20%22$user.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
      },
      {
        "url_name": "Hosts Overview by process name",
        "url_value": "security/hosts/ml-hosts?_g=()&query=(query:'process.name%20:%20%22$process.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
      },
      {
        "url_name": "Hosts Overview by user name",
        "url_value": "security/hosts/ml-hosts?_g=()&query=(query:'user.name%20:%20%22$user.name$%22',language:kuery)&timerange=(global:(linkTo:!(timeline),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')),timeline:(linkTo:!(global),timerange:(from:'$earliest$',kind:absolute,to:'$latest$')))"
      }
    ]
  }
}