11[role="xpack"]
22[[ml-configuring-detector-custom-rules]]
3- === Customizing detectors with rules and filters
3+ === Customizing detectors with custom rules
44
5- <<ml-rules,Rules and filters >> enable you to change the behavior of anomaly
5+ <<ml-rules,Custom rules >> enable you to change the behavior of anomaly
66detectors based on domain-specific knowledge.
77
8- Rules describe _when_ a detector should take a certain _action_ instead
8+ Custom rules describe _when_ a detector should take a certain _action_ instead
99of following its default behavior. To specify the _when_ a rule uses
1010a `scope` and `conditions`. You can think of `scope` as the categorical
1111specification of a rule, while `conditions` are the numerical part.
@@ -14,7 +14,7 @@ scope and conditions.
1414
1515Let us see how those can be configured by examples.
1616
17- ==== Specifying rule scope
17+ ==== Specifying custom rule scope
1818
1919Let us assume we are configuring a job in order to detect DNS data exfiltration.
2020Our data contain fields "subdomain" and "highest_registered_domain".
@@ -127,7 +127,7 @@ PUT _xpack/ml/anomaly_detectors/scoping_multiple_fields
127127Such a detector will skip results when the values of all 3 scoped fields
128128are included in the referenced filters.
129129
130- ==== Specifying rule conditions
130+ ==== Specifying custom rule conditions
131131
132132Imagine a detector that looks for anomalies in CPU utilization.
133133Given a machine that is idle for long enough, small movement in CPU could
@@ -206,17 +206,17 @@ PUT _xpack/ml/anomaly_detectors/rule_with_range
206206----------------------------------
207207// CONSOLE
208208
209- ==== Rules in the life-cycle of a job
209+ ==== Custom rules in the life-cycle of a job
210210
211- Rules only affect results created after the rules were applied.
211+ Custom rules only affect results created after the rules were applied.
212212Let us imagine that we have configured a job and it has been running
213213for some time. After observing its results we decide that we can employ
214214rules in order to get rid of some uninteresting results. We can use
215215the {ref}/ml-update-job.html[update job API] to do so. However, the rule we
216216added will only be in effect for any results created from the moment we added
217217the rule onwards. Past results will remain unaffected.
218218
219- ==== Using rules VS filtering data
219+ ==== Using custom rules VS filtering data
220220
221221It might appear like using rules is just another way of filtering the data
222222that feeds into a job. For example, a rule that skips results when the
0 commit comments