diff --git a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/apache_ecs/ml/datafeed_low_request_rate_ecs.json b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/apache_ecs/ml/datafeed_low_request_rate_ecs.json
index f91e102a3f1c1..98d4feb550c31 100644
--- a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/apache_ecs/ml/datafeed_low_request_rate_ecs.json
+++ b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/apache_ecs/ml/datafeed_low_request_rate_ecs.json
@@ -1,6 +1,6 @@
 {
     "job_id": "JOB_ID",
-    "indexes": [
+    "indices": [
       "INDEX_PATTERN_NAME"
     ],
     "query": {
diff --git a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/apache_ecs/ml/datafeed_source_ip_request_rate_ecs.json b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/apache_ecs/ml/datafeed_source_ip_request_rate_ecs.json
index 824d6a934d865..5ea53cf35ff4b 100644
--- a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/apache_ecs/ml/datafeed_source_ip_request_rate_ecs.json
+++ b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/apache_ecs/ml/datafeed_source_ip_request_rate_ecs.json
@@ -1,6 +1,6 @@
 {
     "job_id": "JOB_ID",
-    "indexes": [
+    "indices": [
       "INDEX_PATTERN_NAME"
     ],
     "query": {
diff --git a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/apache_ecs/ml/datafeed_source_ip_url_count_ecs.json b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/apache_ecs/ml/datafeed_source_ip_url_count_ecs.json
index 824d6a934d865..5ea53cf35ff4b 100644
--- a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/apache_ecs/ml/datafeed_source_ip_url_count_ecs.json
+++ b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/apache_ecs/ml/datafeed_source_ip_url_count_ecs.json
@@ -1,6 +1,6 @@
 {
     "job_id": "JOB_ID",
-    "indexes": [
+    "indices": [
       "INDEX_PATTERN_NAME"
     ],
     "query": {
diff --git a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/apache_ecs/ml/datafeed_status_code_rate_ecs.json b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/apache_ecs/ml/datafeed_status_code_rate_ecs.json
index 824d6a934d865..5ea53cf35ff4b 100644
--- a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/apache_ecs/ml/datafeed_status_code_rate_ecs.json
+++ b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/apache_ecs/ml/datafeed_status_code_rate_ecs.json
@@ -1,6 +1,6 @@
 {
     "job_id": "JOB_ID",
-    "indexes": [
+    "indices": [
       "INDEX_PATTERN_NAME"
     ],
     "query": {
diff --git a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/apache_ecs/ml/datafeed_visitor_rate_ecs.json b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/apache_ecs/ml/datafeed_visitor_rate_ecs.json
index 0a98563f98817..7e5f70e8c8b0b 100644
--- a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/apache_ecs/ml/datafeed_visitor_rate_ecs.json
+++ b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/apache_ecs/ml/datafeed_visitor_rate_ecs.json
@@ -1,6 +1,6 @@
 {
     "job_id": "JOB_ID",
-    "indexes": [
+    "indices": [
       "INDEX_PATTERN_NAME"
     ],
     "query": {
diff --git a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/apm_transaction/ml/datafeed_high_mean_response_time.json b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/apm_transaction/ml/datafeed_high_mean_response_time.json
index 2f22f2c9be3c8..dc37d05d18111 100644
--- a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/apm_transaction/ml/datafeed_high_mean_response_time.json
+++ b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/apm_transaction/ml/datafeed_high_mean_response_time.json
@@ -1,6 +1,6 @@
 {
   "job_id": "JOB_ID",
-  "indexes": [
+  "indices": [
     "INDEX_PATTERN_NAME"
   ],
   "query": {
diff --git a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/auditbeat_process_docker_ecs/ml/datafeed_docker_high_count_process_events_ecs.json b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/auditbeat_process_docker_ecs/ml/datafeed_docker_high_count_process_events_ecs.json
index 483e4dab68333..7370aed5321ac 100644
--- a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/auditbeat_process_docker_ecs/ml/datafeed_docker_high_count_process_events_ecs.json
+++ b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/auditbeat_process_docker_ecs/ml/datafeed_docker_high_count_process_events_ecs.json
@@ -1,6 +1,6 @@
 {
   "job_id": "JOB_ID",
-  "indexes": [
+  "indices": [
     "INDEX_PATTERN_NAME"
   ],
   "query": {
diff --git a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/auditbeat_process_docker_ecs/ml/datafeed_docker_rare_process_activity_ecs.json b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/auditbeat_process_docker_ecs/ml/datafeed_docker_rare_process_activity_ecs.json
index 483e4dab68333..7370aed5321ac 100644
--- a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/auditbeat_process_docker_ecs/ml/datafeed_docker_rare_process_activity_ecs.json
+++ b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/auditbeat_process_docker_ecs/ml/datafeed_docker_rare_process_activity_ecs.json
@@ -1,6 +1,6 @@
 {
   "job_id": "JOB_ID",
-  "indexes": [
+  "indices": [
     "INDEX_PATTERN_NAME"
   ],
   "query": {
diff --git a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/auditbeat_process_hosts_ecs/ml/datafeed_hosts_high_count_process_events_ecs.json b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/auditbeat_process_hosts_ecs/ml/datafeed_hosts_high_count_process_events_ecs.json
index 30d43b331b839..9c04257fb8904 100644
--- a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/auditbeat_process_hosts_ecs/ml/datafeed_hosts_high_count_process_events_ecs.json
+++ b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/auditbeat_process_hosts_ecs/ml/datafeed_hosts_high_count_process_events_ecs.json
@@ -1,6 +1,6 @@
 {
   "job_id": "JOB_ID",
-  "indexes": [
+  "indices": [
     "INDEX_PATTERN_NAME"
   ],
   "query": {
diff --git a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/auditbeat_process_hosts_ecs/ml/datafeed_hosts_rare_process_activity_ecs.json b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/auditbeat_process_hosts_ecs/ml/datafeed_hosts_rare_process_activity_ecs.json
index dea861b70305e..9c04257fb8904 100644
--- a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/auditbeat_process_hosts_ecs/ml/datafeed_hosts_rare_process_activity_ecs.json
+++ b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/auditbeat_process_hosts_ecs/ml/datafeed_hosts_rare_process_activity_ecs.json
@@ -1,6 +1,6 @@
 {
   "job_id": "JOB_ID",
-  "indexes": [
+  "indices": [
     "INDEX_PATTERN_NAME"
   ],
   "query": {
@@ -10,7 +10,7 @@
       ],
       "must": {
         "exists": { "field": "auditd.data.syscall" }
-      },      
+      },
       "must_not": {
         "exists": { "field": "container.runtime" }
       }
diff --git a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/logs_ui_analysis/ml/datafeed_log_entry_rate.json b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/logs_ui_analysis/ml/datafeed_log_entry_rate.json
index 073e72a188616..2ece259e2bb45 100644
--- a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/logs_ui_analysis/ml/datafeed_log_entry_rate.json
+++ b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/logs_ui_analysis/ml/datafeed_log_entry_rate.json
@@ -1,4 +1,4 @@
 {
   "job_id": "JOB_ID",
-  "indexes": ["INDEX_PATTERN_NAME"]
+  "indices": ["INDEX_PATTERN_NAME"]
 }
diff --git a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/metricbeat_system_ecs/ml/datafeed_high_mean_cpu_iowait_ecs.json b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/metricbeat_system_ecs/ml/datafeed_high_mean_cpu_iowait_ecs.json
index fd164e218ee22..fe87160142cff 100644
--- a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/metricbeat_system_ecs/ml/datafeed_high_mean_cpu_iowait_ecs.json
+++ b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/metricbeat_system_ecs/ml/datafeed_high_mean_cpu_iowait_ecs.json
@@ -1,6 +1,6 @@
 {
   "job_id": "JOB_ID",
-  "indexes": [
+  "indices": [
     "INDEX_PATTERN_NAME"
   ],
   "query": {
diff --git a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/metricbeat_system_ecs/ml/datafeed_max_disk_utilization_ecs.json b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/metricbeat_system_ecs/ml/datafeed_max_disk_utilization_ecs.json
index 0b1a6099d6794..6ccbfe94c220c 100644
--- a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/metricbeat_system_ecs/ml/datafeed_max_disk_utilization_ecs.json
+++ b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/metricbeat_system_ecs/ml/datafeed_max_disk_utilization_ecs.json
@@ -1,6 +1,6 @@
 {
     "job_id": "JOB_ID",
-    "indexes": [
+    "indices": [
       "INDEX_PATTERN_NAME"
     ],
     "query": {
diff --git a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/metricbeat_system_ecs/ml/datafeed_metricbeat_outages_ecs.json b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/metricbeat_system_ecs/ml/datafeed_metricbeat_outages_ecs.json
index 35974310eadb2..d6f33127dfc08 100644
--- a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/metricbeat_system_ecs/ml/datafeed_metricbeat_outages_ecs.json
+++ b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/metricbeat_system_ecs/ml/datafeed_metricbeat_outages_ecs.json
@@ -1,6 +1,6 @@
 {
     "job_id": "JOB_ID",
-    "indexes": [
+    "indices": [
       "INDEX_PATTERN_NAME"
     ],
     "query": {
diff --git a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/nginx_ecs/ml/datafeed_low_request_rate_ecs.json b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/nginx_ecs/ml/datafeed_low_request_rate_ecs.json
index d3333928299ea..92f7663f42653 100644
--- a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/nginx_ecs/ml/datafeed_low_request_rate_ecs.json
+++ b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/nginx_ecs/ml/datafeed_low_request_rate_ecs.json
@@ -1,6 +1,6 @@
 {
     "job_id": "JOB_ID",
-    "indexes": [
+    "indices": [
       "INDEX_PATTERN_NAME"
     ],
     "query": {
diff --git a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/nginx_ecs/ml/datafeed_source_ip_request_rate_ecs.json b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/nginx_ecs/ml/datafeed_source_ip_request_rate_ecs.json
index bccf1bd8de6d5..682844b1bc5c7 100644
--- a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/nginx_ecs/ml/datafeed_source_ip_request_rate_ecs.json
+++ b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/nginx_ecs/ml/datafeed_source_ip_request_rate_ecs.json
@@ -1,6 +1,6 @@
 {
     "job_id": "JOB_ID",
-    "indexes": [
+    "indices": [
       "INDEX_PATTERN_NAME"
     ],
     "query": {
diff --git a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/nginx_ecs/ml/datafeed_source_ip_url_count_ecs.json b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/nginx_ecs/ml/datafeed_source_ip_url_count_ecs.json
index bccf1bd8de6d5..682844b1bc5c7 100644
--- a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/nginx_ecs/ml/datafeed_source_ip_url_count_ecs.json
+++ b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/nginx_ecs/ml/datafeed_source_ip_url_count_ecs.json
@@ -1,6 +1,6 @@
 {
     "job_id": "JOB_ID",
-    "indexes": [
+    "indices": [
       "INDEX_PATTERN_NAME"
     ],
     "query": {
diff --git a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/nginx_ecs/ml/datafeed_status_code_rate_ecs.json b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/nginx_ecs/ml/datafeed_status_code_rate_ecs.json
index bccf1bd8de6d5..682844b1bc5c7 100644
--- a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/nginx_ecs/ml/datafeed_status_code_rate_ecs.json
+++ b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/nginx_ecs/ml/datafeed_status_code_rate_ecs.json
@@ -1,6 +1,6 @@
 {
     "job_id": "JOB_ID",
-    "indexes": [
+    "indices": [
       "INDEX_PATTERN_NAME"
     ],
     "query": {
diff --git a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/nginx_ecs/ml/datafeed_visitor_rate_ecs.json b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/nginx_ecs/ml/datafeed_visitor_rate_ecs.json
index e3faf85461938..7027d3e8902bc 100644
--- a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/nginx_ecs/ml/datafeed_visitor_rate_ecs.json
+++ b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/nginx_ecs/ml/datafeed_visitor_rate_ecs.json
@@ -1,6 +1,6 @@
 {
     "job_id": "JOB_ID",
-    "indexes": [
+    "indices": [
       "INDEX_PATTERN_NAME"
     ],
     "query": {
diff --git a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/sample_data_ecommerce/ml/datafeed_high_sum_total_sales.json b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/sample_data_ecommerce/ml/datafeed_high_sum_total_sales.json
index 193239995c6d3..0a955a766bd53 100644
--- a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/sample_data_ecommerce/ml/datafeed_high_sum_total_sales.json
+++ b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/sample_data_ecommerce/ml/datafeed_high_sum_total_sales.json
@@ -1,6 +1,6 @@
 {
   "job_id": "JOB_ID",
-  "indexes": ["INDEX_PATTERN_NAME"],
+  "indices": ["INDEX_PATTERN_NAME"],
   "query": {
     "bool": {
       "filter": [{ "term": { "_index": "kibana_sample_data_ecommerce" } }]
diff --git a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/sample_data_weblogs/ml/datafeed_low_request_rate.json b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/sample_data_weblogs/ml/datafeed_low_request_rate.json
index e2682e2c15008..843a7d1651dc8 100644
--- a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/sample_data_weblogs/ml/datafeed_low_request_rate.json
+++ b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/sample_data_weblogs/ml/datafeed_low_request_rate.json
@@ -1,6 +1,6 @@
 {
   "job_id": "JOB_ID",
-  "indexes": ["INDEX_PATTERN_NAME"],
+  "indices": ["INDEX_PATTERN_NAME"],
   "query": {
     "bool": {
       "filter": [{ "term": { "_index": "kibana_sample_data_logs" } }]
diff --git a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/sample_data_weblogs/ml/datafeed_response_code_rates.json b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/sample_data_weblogs/ml/datafeed_response_code_rates.json
index 3afbfdefc31e8..3a0f67daa392a 100644
--- a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/sample_data_weblogs/ml/datafeed_response_code_rates.json
+++ b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/sample_data_weblogs/ml/datafeed_response_code_rates.json
@@ -1,6 +1,6 @@
 {
   "job_id": "JOB_ID",
-  "indexes": ["INDEX_PATTERN_NAME"],
+  "indices": ["INDEX_PATTERN_NAME"],
   "query": {
     "bool": {
       "filter": [{ "term": { "_index": "kibana_sample_data_logs" } }]
diff --git a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/sample_data_weblogs/ml/datafeed_url_scanning.json b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/sample_data_weblogs/ml/datafeed_url_scanning.json
index 3afbfdefc31e8..3a0f67daa392a 100644
--- a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/sample_data_weblogs/ml/datafeed_url_scanning.json
+++ b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/sample_data_weblogs/ml/datafeed_url_scanning.json
@@ -1,6 +1,6 @@
 {
   "job_id": "JOB_ID",
-  "indexes": ["INDEX_PATTERN_NAME"],
+  "indices": ["INDEX_PATTERN_NAME"],
   "query": {
     "bool": {
       "filter": [{ "term": { "_index": "kibana_sample_data_logs" } }]
diff --git a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_rare_process_by_host_linux_ecs.json b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_rare_process_by_host_linux_ecs.json
index 9de27f5d213f2..93a5646a7bf01 100644
--- a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_rare_process_by_host_linux_ecs.json
+++ b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_rare_process_by_host_linux_ecs.json
@@ -1,6 +1,6 @@
 {
     "job_id": "JOB_ID",
-    "indexes": [
+    "indices": [
       "INDEX_PATTERN_NAME"
     ],
     "max_empty_searches": 10,
diff --git a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_suspicious_login_activity_ecs.json b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_suspicious_login_activity_ecs.json
index e92ba08378fab..a177abfd0f116 100644
--- a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_suspicious_login_activity_ecs.json
+++ b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat/ml/datafeed_suspicious_login_activity_ecs.json
@@ -1,6 +1,6 @@
 {
   "job_id": "JOB_ID",
-  "indexes": [
+  "indices": [
     "INDEX_PATTERN_NAME"
   ],
   "max_empty_searches": 10,
diff --git a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat_auth/ml/datafeed_suspicious_login_activity_ecs.json b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat_auth/ml/datafeed_suspicious_login_activity_ecs.json
index 75e7148b4db1a..386b9fab25667 100644
--- a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat_auth/ml/datafeed_suspicious_login_activity_ecs.json
+++ b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_auditbeat_auth/ml/datafeed_suspicious_login_activity_ecs.json
@@ -1,6 +1,6 @@
 {
   "job_id": "JOB_ID",
-  "indexes": [
+  "indices": [
     "INDEX_PATTERN_NAME"
   ],
   "max_empty_searches": 10,
diff --git a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat/ml/datafeed_rare_process_by_host_windows_ecs.json b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat/ml/datafeed_rare_process_by_host_windows_ecs.json
index 81519bf6001e3..6daa5881575ab 100644
--- a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat/ml/datafeed_rare_process_by_host_windows_ecs.json
+++ b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat/ml/datafeed_rare_process_by_host_windows_ecs.json
@@ -1,6 +1,6 @@
 {
     "job_id": "JOB_ID",
-    "indexes": [
+    "indices": [
       "INDEX_PATTERN_NAME"
     ],
     "max_empty_searches": 10,
diff --git a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat_auth/ml/windows_rare_user_type10_remote_login.json b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat_auth/ml/windows_rare_user_type10_remote_login.json
index b9992a9e01182..ee009e465ec23 100644
--- a/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat_auth/ml/windows_rare_user_type10_remote_login.json
+++ b/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_winlogbeat_auth/ml/windows_rare_user_type10_remote_login.json
@@ -1,6 +1,6 @@
 {
   "job_type": "anomaly_detector",
-  "description": "SIEM Winlogbeat Auth: Unusual terminal services users can indicate account takeover or credentialed access (beta)",
+  "description": "SIEM Winlogbeat Auth: Unusual RDP (remote desktop protocol) user logins can indicate account takeover or credentialed access (beta)",
   "groups": [
     "siem",
     "winlogbeat",
@@ -49,4 +49,4 @@
       }
     ]
   }
-}
\ No newline at end of file
+}