[Security Solution][Detections] Format Custom Machine Learning Job Field to Time Format in Alert View #90564
Labels
enhancement
New value added to drive a business result
Feature:Detection Alerts
Security Solution Detection Alerts Feature
Feature:Detection Rules
Security Solution rules and Detection Engine
Feature:ML Rule
Security Solution Machine Learning rule type
sec-specialists
Team:Detection Engine
Security Solution Detection Engine Area
Team:Detections and Resp
Security Detection Response Team
Describe the feature:
Currently in the detections engine, if a custom machine learning job with a detector of
time_of_day
ortime_of_week
is triggered, the value of the field is presented as a double.However, Inside of the Machine Learning > Anomaly Detection > Anomaly Explorer function, the correct format is presented. The logic from the Anomaly Explorer should be ported across to Signals
Machine Learning Raw Document
![Raw Document](https://camo.githubusercontent.com/c2132ee0d7d1930a8a41e9a68ea255a634a999592bff906ebb3ae5a4bf6992d6/68747470733a2f2f692e6962622e636f2f447244686e38662f6d6c526573756c742e706e67)
Machine Learning Anomaly Explorer
![Anomaly View](https://camo.githubusercontent.com/8fbf214eb6c69663991e4c196d7aa2b12cf2557ca66f2fde137848ac82e854b6/68747470733a2f2f692e6962622e636f2f4e6a31486a64472f616e6f6d616c792d566965772d3030322e706e67)
SIEM UI
![SIEM Alert](https://camo.githubusercontent.com/212c9c584b116b25296bfe4f3a84b32fbbc060a22f6b206bd6cf3650f0b649e7/68747470733a2f2f692e6962622e636f2f5654683030466a2f3030332d5369656d2d55492e706e67)
Describe a specific use case for the feature:
Unusual time of day and unusual time of the week is common Machine Learning jobs to create when detecting anomalous user behaviour. Humans are not good at converting
doubles
to time formats on the fly. This formatting function will help analysts in the future once we adopt more of these time-based machine learning jobs. My expectation is the output would look similar to image in the Anomaly ExplorerThis is dependant on #90344
The text was updated successfully, but these errors were encountered: