19 lines
533 B
YAML
19 lines
533 B
YAML
type: bayesian
|
|
name: test/simple-bayesian
|
|
debug: true
|
|
description: "bayesian bucket"
|
|
filter: "evt.Meta.log_type == 'http_access-log' || evt.Meta.log_type == 'ssh_access-log'"
|
|
groupby: evt.Meta.source_ip
|
|
bayesian_prior: 0.5
|
|
bayesian_threshold: 0.8
|
|
bayesian_conditions:
|
|
- condition: any(queue.Queue, {.Meta.http_path == "/"})
|
|
prob_given_evil: 0.8
|
|
prob_given_benign: 0.2
|
|
- condition: any(queue.Queue, {.Meta.ssh_user == "admin"})
|
|
prob_given_evil: 0.9
|
|
prob_given_benign: 0.5
|
|
leakspeed: 30s
|
|
capacity: -1
|
|
labels:
|
|
type: overflow_1 |