sudden_appearance_new_process_location.conf

##############################
# SUDDEN APPEARANCE - NEW PROCESS LOCATION
##############################
[sudden_appearance_winlog_new_process_location]
es_query_filter=_exists_:winlog.event_id AND winlog.event_id:1

aggregator=meta.deployment_name.keyword, process.name
target=process.executable

history_window_days=7
history_window_hours=0

# Size of the sliding window defined in DDD:HH:MM
# Therefore, 20:13:20 will correspond to 20 days 13 hours and 20 minutes
sliding_window_size=01:00:00

sliding_window_step_size=00:01:00

outlier_type=first observation
outlier_reason=sudden appearance of new process location
outlier_summary=sudden appearance of new process location {process.executable}

run_model=1
test_model=0