Skip to content

[pad] Update ML jobs description and groups for Privileged Access Detection #14268

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
+49 −23
Open

[pad] Update ML jobs description and groups for Privileged Access Detection #14268

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a80da72
update manifest and changelog
sodhikirti07 Jun 19, 2025
a83eb3d
update ml job groups and description
sodhikirti07 Jun 19, 2025
f2a6020
update changelog.yml
sodhikirti07 Jun 19, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions packages/pad/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,8 @@
- version: "0.6.0"
changes:
- description: Update ML jobs description and groups
type: enhancement
link: https://github.com/elastic/integrations/pull/14268
- version: "0.5.0"
changes:
- description: Fix bug in the dashboard
Expand Down
65 changes: 43 additions & 22 deletions packages/pad/kibana/ml_module/pad-ml.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,7 +80,8 @@
"config": {
"groups": [
"security",
"pad"
"pad",
"windows"
],
"description": "Detects unusually high special logon events initiated by a user.",
"analysis_config": {
Expand Down Expand Up @@ -117,7 +118,8 @@
"config": {
"groups": [
"security",
"pad"
"pad",
"windows"
],
"description": "Detects unusually high special privilege use events initiated by a user.",
"analysis_config": {
Expand Down Expand Up @@ -153,7 +155,8 @@
"config": {
"groups": [
"security",
"pad"
"pad",
"windows"
],
"description": "Detects unusually high security group management events initiated by a user.",
"analysis_config": {
Expand Down Expand Up @@ -189,7 +192,8 @@
"config": {
"groups": [
"security",
"pad"
"pad",
"windows"
],
"description": "Detects unusually high security user account management events initiated by a user.",
"analysis_config": {
Expand Down Expand Up @@ -224,7 +228,8 @@
"config": {
"groups": [
"security",
"pad"
"pad",
"windows"
],
"description": "Detects an unusual privilege type assigned to a user.",
"analysis_config": {
Expand Down Expand Up @@ -259,7 +264,8 @@
"config": {
"groups": [
"security",
"pad"
"pad",
"windows"
],
"description": "Detects an unusual group name accessed by a user.",
"analysis_config": {
Expand Down Expand Up @@ -295,7 +301,8 @@
"config": {
"groups": [
"security",
"pad"
"pad",
"windows"
],
"description": "Detects an unusual device accessed by a user.",
"analysis_config": {
Expand Down Expand Up @@ -331,7 +338,8 @@
"config": {
"groups": [
"security",
"pad"
"pad",
"windows"
],
"description": "Detects an unusual source IP address accessed by a user.",
"analysis_config": {
Expand Down Expand Up @@ -367,7 +375,8 @@
"config": {
"groups": [
"security",
"pad"
"pad",
"windows"
],
"description": "Detects an unusual region name for a user.",
"analysis_config": {
Expand Down Expand Up @@ -404,7 +413,8 @@
"config": {
"groups": [
"security",
"pad"
"pad",
"linux"
],
"description": "Detects a spike in privileged commands executed by a user.",
"analysis_config": {
Expand Down Expand Up @@ -438,7 +448,8 @@
"config": {
"groups": [
"security",
"pad"
"pad",
"linux"
],
"description": "Detects a rare process executed by a user.",
"analysis_config": {
Expand Down Expand Up @@ -472,9 +483,10 @@
"config": {
"groups": [
"security",
"pad"
"pad",
"linux"
],
"description": "Detects process command lines executed by a user with an abnormally high median entropy value",
"description": "Detects process command lines executed by a user with an abnormally high median entropy value. This job requires some manual setup before it can run successfully, specifically adding custom field mappings for data coming from an ingest pipeline. Instructions for these steps are available in the package overview.",
"analysis_config": {
"bucket_span": "30m",
"detectors": [
Expand Down Expand Up @@ -506,7 +518,8 @@
"config": {
"groups": [
"security",
"pad"
"pad",
"okta"
],
"description": "Detects spike in group membership change events by a user.",
"analysis_config": {
Expand Down Expand Up @@ -542,7 +555,8 @@
"config": {
"groups": [
"security",
"pad"
"pad",
"okta"
],
"description": "Detects spike in user lifecycle management change events by a user.",
"analysis_config": {
Expand Down Expand Up @@ -578,7 +592,8 @@
"config": {
"groups": [
"security",
"pad"
"pad",
"okta"
],
"description": "Detects spike in group privilege change events by a user.",
"analysis_config": {
Expand Down Expand Up @@ -616,7 +631,8 @@
"config": {
"groups": [
"security",
"pad"
"pad",
"okta"
],
"description": "Detects spike in group application assignment change events by a user.",
"analysis_config": {
Expand Down Expand Up @@ -651,7 +667,8 @@
"config": {
"groups": [
"security",
"pad"
"pad",
"okta"
],
"description": "Detects spike in group lifecycle change events by a user.",
"analysis_config": {
Expand Down Expand Up @@ -686,7 +703,8 @@
"config": {
"groups": [
"security",
"pad"
"pad",
"okta"
],
"description": "Detects an unusual sum of active sessions started by a user.",
"analysis_config": {
Expand Down Expand Up @@ -720,7 +738,8 @@
"config": {
"groups": [
"security",
"pad"
"pad",
"okta"
],
"description": "Detects an unusual source IP address accessed by a user.",
"analysis_config": {
Expand Down Expand Up @@ -755,7 +774,8 @@
"config": {
"groups": [
"security",
"pad"
"pad",
"okta"
],
"description": "Detects an unusual region name for a user.",
"analysis_config": {
Expand Down Expand Up @@ -791,7 +811,8 @@
"config": {
"groups": [
"security",
"pad"
"pad",
"okta"
],
"description": "Detects an unusual host name for a user.",
"analysis_config": {
Expand Down
2 changes: 1 addition & 1 deletion packages/pad/manifest.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
format_version: 3.0.0
name: pad
title: "Privileged Access Detection"
version: 0.5.0
version: 0.6.0
source:
license: "Elastic-2.0"
description: "ML package to detect anomalous privileged access activity in Windows, Linux and Okta logs"
Expand Down