For details, reference: https://github.com/elastic/detection-rules/tree/main/docs/experimental-machine-learning

Tested and compatible with Elastic Stack version 8.3.

Changelog

• This is the first version of the user risk score app which calculates a normalized risk score for user names using the risk scores in the available alerts

Note on installation

As of Elastic Stack version 8.3, we no longer recommend installing User Risk Score using this release bundle. Please follow the official documentation for steps to install User Risk Score based on your Stack version.

For details, reference: https://github.com/elastic/detection-rules/tree/main/docs/experimental-machine-learning

Tested and compatible with Elastic Stack version 8.1.

Changelog

• Adding multipliers to boost the host risk score based on certain properties
• Adding some explainability about the host risk score

For details, reference: https://github.com/elastic/detection-rules/tree/main/docs/experimental-machine-learning

Tested and compatible with Elastic Stack version 7.16.

Changelog

This is the first release for our experimental Network Beaconing framework. It consists of the following:

• Scripts, ingest pipelines and transforms to monitor network event data and flag beaconing-like activity
• dashboards.ndjson contains all the assets required for three dashboards- "Network Beaconing", which is the main dashboard to monitor beaconing activity, "Beaconing Drilldown" to drilldown into relevant event logs and some statistics related to the beaconing activity, and finally, "Hosts Affected Over Time By Process Name" to monitor the reach of beaconing processes across hosts in your environment, in the past two weeks.

For details, reference: https://github.com/elastic/detection-rules/tree/main/docs/experimental-machine-learning

Tested and compatible with Elastic Stack version 8.0.

Changelog

• Updating the alerts alias to reflect changes made in 8.0

changelog

detections added

Beaconing

• ML jobs:
  • beaconing_rare_process

Registry of experimental detections

Experimental detections

For details, reference: https://github.com/elastic/detection-rules/tree/main/docs/experimental-machine-learning

Tested and compatible with Elastic Stack version 7.16.

Changelog

• Updating all the necessary artifacts to account for space awareness, mainly the transforms and dashboard blob.

For details, reference: https://github.com/elastic/detection-rules/tree/main/docs/experimental-machine-learning

Tested and compatible with Elastic Stack version 7.15.

Changelog

• ml_hostriskscore_pivot_transform now incorporates time decay i.e. older alerts have lesser impact on the risk than more recent alerts
• Two new scripts, namely ml_hostriskscore_map_script and ml_hostriskscore_reduce_script to support changes in ml_hostriskscore_pivot_transform
• Changes to the ml_hostriskscore_levels_script and ml_hostriskscore_ingest_pipeline to account for changes to the ml_hostriskscore_pivot_transform
• Dashboards updated to 7.13.4: Running 2 versions behind the latest (7.15.0) to give users time to upgrade

changelog

detections added

URL Spoofing

• Experimental Rules
  • 47b1a804-4f65-40b0-a7ef-fdac3c00b00c: Added new rule for url_spoofing.prediction: phishing (model prediction) or abuseurl_label: 1 (threat intelligence enrichment)

Registry of experimental detections

Experimental detections

model name: urlspoof_20210803_1.0
sha256: 4cbd8d82d382864d28147c5f80ac86108e774319bbe5d2c4c9f3c68d9f86e01e
for details, reference: https://github.com/elastic/detection-rules/tree/main/docs/experimental-machine-learning

changelog

This is the first release package for URL Spoofing. It consists of the following:

• Feature Extraction Scripts:

  • ml_urlspoof_char_continuity_script.json: Calculate the continuity of different parts of a the domain (i.e. number of consecutive characters before seeing a number)
  • ml_urlspoof_domain_entropy_script.json: Calculate the entropy of the URL domain
  • ml_urlspoof_keyword_extractor_script.json: Extract keywords of interest from certain features
  • ml_urlspoof_ngrams_extractor_script.json: Extract ngrams from certain features
  • ml_urlspoof_remove_features_script.json: Remove extra fields created for prediction purposes to avoid cluttering incoming documents - this will NOT remove any of your original fields in your documents
  • ml_urlspoof_tld_keyword_extractor_script.json: Extract top level domain related keywords of interest from certain features

• Model:

  • ml_urlspoof_model.json: Supervised model to classify URLs as malicious vs benign

• Inference Pipeline:

  • ml_urlspoof_inference_pipeline.json: Inference pipeline to make predictions on URLs using the URL Spoofing model and threat intelligence enrichments

• Training Pipeline:

  • ml_urlspoof_features_pipeline.json: Training pipeline used to train the URL Spoofing model - this is primarily for analysts looking for a starting point to train their own model

For details, reference: https://github.com/elastic/detection-rules/tree/main/docs/experimental-machine-learning/

Tested and compatible with Elastic Stack version 7.14.

Changelog

This is the first release package for Host Risk Score. It consists of the following:

• Scripts, ingest pipelines and transforms used to calculate and update risk score across all hosts in your environment
• dashboards.ndjson contains all the assets required for two dashboards- "Current Risk Score for Hosts", which shows the Top 20 currently risky hosts in your environment and "Drilldown of Host Risk Score" which allows users to drill down further into the details of the risk components associated with a particular host.