Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security Solution][Detections] Format Custom Machine Learning Job Field to Time Format in Alert View #90564

Open
Tracked by #165878
secops4thewin opened this issue Feb 8, 2021 · 2 comments
Labels
enhancement New value added to drive a business result Feature:Detection Alerts Security Solution Detection Alerts Feature Feature:Detection Rules Security Solution rules and Detection Engine Feature:ML Rule Security Solution Machine Learning rule type sec-specialists Team:Detection Engine Security Solution Detection Engine Area Team:Detections and Resp Security Detection Response Team

Comments

@secops4thewin
Copy link

Describe the feature:

Currently in the detections engine, if a custom machine learning job with a detector of time_of_day or time_of_week is triggered, the value of the field is presented as a double.

However, Inside of the Machine Learning > Anomaly Detection > Anomaly Explorer function, the correct format is presented. The logic from the Anomaly Explorer should be ported across to Signals

Machine Learning Raw Document
Raw Document

Machine Learning Anomaly Explorer
Anomaly View

SIEM UI
SIEM Alert

Describe a specific use case for the feature:

Unusual time of day and unusual time of the week is common Machine Learning jobs to create when detecting anomalous user behaviour. Humans are not good at converting doubles to time formats on the fly. This formatting function will help analysts in the future once we adopt more of these time-based machine learning jobs. My expectation is the output would look similar to image in the Anomaly Explorer

This is dependant on #90344

@secops4thewin secops4thewin added sec-specialists Team:Detections and Resp Security Detection Response Team labels Feb 8, 2021
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@secops4thewin secops4thewin added Feature:Detection Rules Security Solution rules and Detection Engine Feature:Detection Alerts Security Solution Detection Alerts Feature labels Feb 8, 2021
@secops4thewin secops4thewin changed the title [Security Solution][Detections] Format Custom Machine Learning Job Field to HH:MM in Alert View [Security Solution][Detections] Format Custom Machine Learning Job Field to Time Format in Alert View Feb 8, 2021
@secops4thewin
Copy link
Author

This may be the code that performs the function
Date Time Formatter

@spong spong added the bug Fixes for quality problems that affect the customer experience label Feb 9, 2021
@peluja1012 peluja1012 added Feature:ML Rule Security Solution Machine Learning rule type Team:Detection Alerts Security Detection Alerts Area Team impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. labels Mar 18, 2022
@marshallmain marshallmain added enhancement New value added to drive a business result and removed bug Fixes for quality problems that affect the customer experience impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. labels Mar 29, 2022
@yctercero yctercero added Team:Detection Engine Security Solution Detection Engine Area and removed Team:Detection Alerts Security Detection Alerts Area Team labels May 13, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New value added to drive a business result Feature:Detection Alerts Security Solution Detection Alerts Feature Feature:Detection Rules Security Solution rules and Detection Engine Feature:ML Rule Security Solution Machine Learning rule type sec-specialists Team:Detection Engine Security Solution Detection Engine Area Team:Detections and Resp Security Detection Response Team
Projects
None yet
Development

No branches or pull requests

6 participants