@@ -16,7 +16,7 @@ Let us see how those can be configured by examples.
1616
1717==== Specifying rule scope
1818
19- Let us assume we are configuring a job in order to DNS data exfiltration.
19+ Let us assume we are configuring a job in order to detect DNS data exfiltration.
2020Our data contain fields "subdomain" and "highest_registered_domain".
2121We can use a detector that looks like `high_info_content(subdomain) over highest_registered_domain`.
2222If we run such a job it is possible that we discover a lot of anomalies on
@@ -25,8 +25,8 @@ are not interested in such anomalies. Ideally, we could instruct the detector to
2525skip results for domains that we consider safe. Using a rule with a scope allows
2626us to achieve this.
2727
28- First, we need to create a list with our safe domains. Those lists are called
29- `filters` in {ml}. Filters can be shared across jobs.
28+ First, we need to create a list of our safe domains. Those lists are called
29+ _filters_ in {ml}. Filters can be shared across jobs.
3030
3131We create our filter using the {ref}/ml-put-filter.html[put filter API]:
3232
@@ -40,8 +40,8 @@ PUT _xpack/ml/filters/safe_domains
4040----------------------------------
4141// CONSOLE
4242
43- Now, we can create our job specifying a scope that uses the filter for the
44- `highest_registered_domain` field:
43+ Now, we can create our job specifying a scope that uses the `safe_domains`
44+ filter for the `highest_registered_domain` field:
4545
4646[source,js]
4747----------------------------------
@@ -85,7 +85,9 @@ POST _xpack/ml/filters/safe_domains/_update
8585// CONSOLE
8686// TEST[setup:ml_filter_safe_domains]
8787
88- Note that we can provide scope for any of the partition/over/by fields.
88+ Note that we can use any of the `partition_field_name`, `over_field_name`, or
89+ `by_field_name` fields in the `scope`.
90+
8991In the following example we scope multiple fields:
9092
9193[source,js]
@@ -210,9 +212,9 @@ Rules only affect results created after the rules were applied.
210212Let us imagine that we have configured a job and it has been running
211213for some time. After observing its results we decide that we can employ
212214rules in order to get rid of some uninteresting results. We can use
213- the update-job API to do so. However, the rule we added will only be in effect
214- for any results created from the moment we added the rule onwards. Past results
215- will remain unaffected.
215+ the {ref}/ml- update-job.html[update job API] to do so. However, the rule we
216+ added will only be in effect for any results created from the moment we added
217+ the rule onwards. Past results will remain unaffected.
216218
217219==== Using rules VS filtering data
218220
0 commit comments