Files
elastic-detection-rules/detection_rules
Samirbous 6cf5040f37 [New] Multiple Machine Learning Alerts by Influencer Field (#5660)
* [New] Multiple Machine Learning Alerts by Influencer Field

This rule uses alerts data to determine when multiple different machine learning alerts involving the same influencer field are triggered. Analysts can use this to prioritize triage and response, as these entities are more likely to be more suspicious.

* Update multiple_machine_learning_jobs_by_entity.toml

* Update multiple_machine_learning_jobs_by_entity.toml

* Update non-ecs-schema.json

* Update multiple_machine_learning_jobs_by_entity.toml

* Update non-ecs-schema.json

(cherry picked from commit 362c459094)
2026-02-04 12:29:14 +00:00
..
2026-01-12 15:40:35 +00:00
2025-11-17 14:57:54 +00:00
2025-11-17 14:57:54 +00:00