Skip to content

Commit 409e490

Browse files
committed
remove duplicate job
1 parent b5755ce commit 409e490

File tree

1 file changed

+0
-1
lines changed

1 file changed

+0
-1
lines changed

reference/data-analysis/machine-learning/ootb-ml-jobs-siem.md

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,6 @@ In the {{ml-app}} app, these configurations are available only when data exists
5050
| azure_activitylogs_rare_event_action_for_a_city | Looks for Azure activity event actions that, while not inherently suspicious or abnormal, are sourcing from a geolocation (city) that is unusual. This can be the result of compromised credentials or keys.| [code](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/azure_activitylogs/ml/azure_activitylogs_rare_event_action_for_a_city.json)| [code](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/azure_activitylogs/ml/datafeed_azure_activitylogs_rare_event_action_for_a_city.json)| [Azure Activity Logs](https://www.elastic.co/docs/reference/integrations/azure/activitylogs) |
5151
| azure_activitylogs_rare_event_action_for_a_country | Looks for Azure activity event actions that, while not inherently suspicious or abnormal, are sourcing from a geolocation (country) that is unusual. This can be the result of compromised credentials or keys. | [code](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/azure_activitylogs/ml/azure_activitylogs_rare_event_action_for_a_country.json)| [code](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/azure_activitylogs/ml/datafeed_azure_activitylogs_rare_event_action_for_a_country.json)| [Azure Activity Logs](https://www.elastic.co/docs/reference/integrations/azure/activitylogs) |
5252
| azure_activitylogs_rare_event_action_for_a_username | Looks for Azure activity event actions that, while not inherently suspicious or abnormal, are sourcing from a user context that does not normally call the method. This can be the result of compromised credentials or keys as someone uses a valid account to persist, move laterally, or exfil data. | [code](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/azure_activitylogs/ml/azure_activitylogs_rare_event_action_for_a_username.json)| [code](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/azure_activitylogs/ml/datafeed_azure_activitylogs_rare_event_action_for_a_username.json)| [Azure Activity Logs](https://www.elastic.co/docs/reference/integrations/azure/activitylogs) |
53-
| azure_activitylogs_rare_event_action_for_a_user_email | Looks for Azure activity event actions that, while not inherently suspicious or abnormal, are sourcing from a user email that does not normally call the method. This can be the result of compromised credentials or keys as someone uses a valid account to persist, move laterally, or exfil data. | [code](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/azure_activitylogs/ml/azure_activitylogs_rare_event_action_for_a_user_email.json)| [code](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/azure_activitylogs/ml/datafeed_azure_activitylogs_rare_event_action_for_a_user_email.json)| [Azure Activity Logs](https://www.elastic.co/docs/reference/integrations/azure/activitylogs) |
5453

5554

5655
## Security: CloudTrail [security-cloudtrail-jobs]

0 commit comments

Comments
 (0)