Provide more details on how to start ML job to avoid ML detection rule execution failure #1160

joepeeples · 2021-10-14T20:23:27Z

Addresses #1137.

Preview pages:

* Adds to both rule creation and troubleshooting topics * Adds new screenshots to highlight the correct feature to use

lcawl

LGTM

nastasha-solomon

LGTM!

docs/troubleshooting/detections/detection-rules.asciidoc

jmikell821

One super small nit/comment. Let's backport this to 7.16, 7.15, 7.14.

Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com>

spong

LGTM! Thanks for these clarifying additions @joepeeples.

Long-term it would be nice to make some UX enhancements to the Rule Creation/Details UI to allow for one-click enabling of the disabled jobs. I know we were hoping to add a shortcut link to auto-open the ML Job Settings UI with it filtered to the appropriate jobs, but we didn't get to that in initial dev. This is probably something we can track now as part of any changes around the ML Job Settings UI/Workflows here (https://github.com/elastic/security-team/issues/1912) -- till then though these doc updates will really help out, thanks! 🙂

joepeeples · 2021-11-01T14:51:11Z

Thanks for the review and extra context, @spong! I'll follow #1912 to keep up with any UI developments in the future.

jmikell821 · 2021-11-04T18:06:11Z

@cybersecdiva we're waiting on your review so we can close this PR out. Thanks.

…e execution failure (#1160) * First draft * Adds to both rule creation and troubleshooting topics * Adds new screenshots to highlight the correct feature to use * Update rule-start-ml-job.png * Corrects name of custom query rule * Update docs/troubleshooting/detections/detection-rules.asciidoc Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> (cherry picked from commit b91a2a0)

…e execution failure (#1160) * First draft * Adds to both rule creation and troubleshooting topics * Adds new screenshots to highlight the correct feature to use * Update rule-start-ml-job.png * Corrects name of custom query rule * Update docs/troubleshooting/detections/detection-rules.asciidoc Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> (cherry picked from commit b91a2a0) # Conflicts: # docs/troubleshooting/detections/detection-rules.asciidoc

…detection rule execution failure (#1160) (#1218) * First draft * Adds to both rule creation and troubleshooting topics * Adds new screenshots to highlight the correct feature to use * Update rule-start-ml-job.png * Corrects name of custom query rule * Update docs/troubleshooting/detections/detection-rules.asciidoc Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> (cherry picked from commit b91a2a0) Co-authored-by: Joe Peeples <joe.peeples@elastic.co>

… detection rule execution failure (#1160) (#1219) * First draft * Adds to both rule creation and troubleshooting topics * Adds new screenshots to highlight the correct feature to use * Update rule-start-ml-job.png * Corrects name of custom query rule * Update docs/troubleshooting/detections/detection-rules.asciidoc Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> (cherry picked from commit b91a2a0) Co-authored-by: Joe Peeples <joe.peeples@elastic.co>

… detection rule execution failure (#1160) (#1220) * First draft * Adds to both rule creation and troubleshooting topics * Adds new screenshots to highlight the correct feature to use * Update rule-start-ml-job.png * Corrects name of custom query rule * Update docs/troubleshooting/detections/detection-rules.asciidoc Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> (cherry picked from commit b91a2a0) Co-authored-by: Joe Peeples <joe.peeples@elastic.co>

…e execution failure (elastic#1160) * First draft * Adds to both rule creation and troubleshooting topics * Adds new screenshots to highlight the correct feature to use * Update rule-start-ml-job.png * Corrects name of custom query rule * Update docs/troubleshooting/detections/detection-rules.asciidoc Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> # Conflicts: # docs/troubleshooting/detections/detection-rules.asciidoc

… detection rule execution failure (#1160) (#1222) * Provide more details on how to start ML job to avoid ML detection rule execution failure (#1160) * First draft * Adds to both rule creation and troubleshooting topics * Adds new screenshots to highlight the correct feature to use * Update rule-start-ml-job.png * Corrects name of custom query rule * Update docs/troubleshooting/detections/detection-rules.asciidoc Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> # Conflicts: # docs/troubleshooting/detections/detection-rules.asciidoc * Rearrange template-script and troubleshooting-intro

cybersecdiva · 2021-11-19T17:12:38Z

@jmikell821 I provided feedback to @joepeeples and one addition I would make is to add a section if this does not resolve the user's issue to reach out to our community discuss.elastic.co or Elastic Community Slack channel (elasticstack.slack.com)
In addition, I will create an issue later on other specifics in security-docs that may be helpful if this is a failed step and does not resolve the user's issue, recommended next steps we can add for troubleshooting for the users as a verification ✅

First draft

7127dae

* Adds to both rule creation and troubleshooting topics * Adds new screenshots to highlight the correct feature to use

joepeeples added Team: Docs Team: Detections/Response Detections and Response edit Docs that need minor updates or revisions. v7.16.0 labels Oct 14, 2021

joepeeples self-assigned this Oct 14, 2021

joepeeples added 4 commits October 14, 2021 16:24

Merge branch 'main' into issue-1137-start-ML-job

8c94d1a

Update rule-start-ml-job.png

3409ea5

Corrects name of custom query rule

3d55bba

Merge branch 'main' into issue-1137-start-ML-job

34adb11

joepeeples requested review from jmikell821, nastasha-solomon and lcawl October 18, 2021 20:28

joepeeples marked this pull request as ready for review October 18, 2021 20:28

joepeeples mentioned this pull request Oct 18, 2021

[DOCS] Provide more details on how to start ML job to avoid ML detection rule execution failure #1137

Closed

joepeeples requested a review from louisong October 18, 2021 20:53

Merge branch 'main' into issue-1137-start-ML-job

082217c

lcawl approved these changes Oct 19, 2021

View reviewed changes

nastasha-solomon approved these changes Oct 19, 2021

View reviewed changes

jmikell821 reviewed Oct 21, 2021

View reviewed changes

docs/troubleshooting/detections/detection-rules.asciidoc Outdated Show resolved Hide resolved

jmikell821 reviewed Oct 21, 2021

View reviewed changes

jmikell821 added v7.15.0 v7.14.0 labels Oct 21, 2021

joepeeples and others added 2 commits October 21, 2021 16:33

Update docs/troubleshooting/detections/detection-rules.asciidoc

84f0c6f

Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com>

Merge branch 'main' into issue-1137-start-ML-job

e0d9f09

cybersecdiva self-requested a review October 27, 2021 13:42

Merge branch 'main' into issue-1137-start-ML-job

9014cdc

joepeeples added the v8.0.0 label Nov 1, 2021

spong approved these changes Nov 1, 2021

View reviewed changes

joepeeples added 2 commits November 15, 2021 09:29

Merge branch 'main' into issue-1137-start-ML-job

6e363ed

Merge branch 'main' into issue-1137-start-ML-job

1bece7a

joepeeples merged commit b91a2a0 into main Nov 16, 2021

mergify bot mentioned this pull request Nov 16, 2021

[8.0] Provide more details on how to start ML job to avoid ML detection rule execution failure (backport #1160) #1218

Merged

mergify bot mentioned this pull request Nov 16, 2021

[7.16] Provide more details on how to start ML job to avoid ML detection rule execution failure (backport #1160) #1219

Merged

mergify bot mentioned this pull request Nov 16, 2021

[7.15] Provide more details on how to start ML job to avoid ML detection rule execution failure (backport #1160) #1220

Merged

mergify bot mentioned this pull request Nov 16, 2021

[7.14] Provide more details on how to start ML job to avoid ML detection rule execution failure (backport #1160) #1221

Closed

joepeeples mentioned this pull request Nov 16, 2021

[7.14] Provide more details on how to start ML job to avoid ML detection rule execution failure (#1160) #1222

Merged

joepeeples deleted the issue-1137-start-ML-job branch November 16, 2021 22:31

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Provide more details on how to start ML job to avoid ML detection rule execution failure #1160

Provide more details on how to start ML job to avoid ML detection rule execution failure #1160

joepeeples commented Oct 14, 2021 •

edited

Loading

lcawl left a comment

nastasha-solomon left a comment

jmikell821 left a comment

spong left a comment

joepeeples commented Nov 1, 2021

jmikell821 commented Nov 4, 2021

cybersecdiva commented Nov 19, 2021 •

edited

Loading

Provide more details on how to start ML job to avoid ML detection rule execution failure #1160

Provide more details on how to start ML job to avoid ML detection rule execution failure #1160

Conversation

joepeeples commented Oct 14, 2021 • edited Loading

lcawl left a comment

Choose a reason for hiding this comment

nastasha-solomon left a comment

Choose a reason for hiding this comment

jmikell821 left a comment

Choose a reason for hiding this comment

spong left a comment

Choose a reason for hiding this comment

joepeeples commented Nov 1, 2021

jmikell821 commented Nov 4, 2021

cybersecdiva commented Nov 19, 2021 • edited Loading

joepeeples commented Oct 14, 2021 •

edited

Loading

cybersecdiva commented Nov 19, 2021 •

edited

Loading