[ML][8.18 & 8.19][Bug] Elastic.co : 404 - page not found: Broken links for anomaly detection supplied configurations in 8.18 and 8.19 branches

[LOBrien-EGS]

Kibana version:

Elasticsearch version:

Server OS version:

Browser version:
Chrome Version 142.0.7444.176 (Official Build) (arm64)

Browser OS version:

Original install method (e.g. download page, yum, from source, etc.):

Describe the bug:

Steps to reproduce:

1. browse to link: https://www.elastic.co/guide/en/machine-learning/8.18/ootb-ml-jobs-siem.html
2. From table with Titles: Name, Description, Job, Datafeed select "Job" for "auth_high_count_logon_events" row

Expected behavior:
https://www.elastic.co/guide/en/machine-learning/8.17/ootb-ml-jobs-siem.html
Screenshots (if relevant):

Errors in browser console (if relevant):
404 - page not found
The 8.18 branch of kibana does not contain the path
x-pack/plugins/ml/server/models/data_recognizer/modules/security_auth/ml/auth_high_count_logon_events.json.

Provide logs and/or server output (if relevant):

Any additional context:
Works the 8.17 link provided in the "Expected Behavior" section.

[elasticmachine]

Pinging @elastic/ml-ui (:ml)

[peteharverson]

Looks like all the doc links for the anomaly detection supplied configuration job and datafeed configs need updating for the following configs:

• APM
• Auditbeat
• Logs
• Metricbeat
• Metrics
• Security
• Uptime

Currently they point at e.g.

https://github.com/elastic/kibana/blob/8.19/x-pack/plugins/ml/server/models/data_recognizer/modules/security_auth/ml/auth_high_count_logon_events.json

but they need to be in the format

https://github.com/elastic/kibana/blob/8.19/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/security_auth/ml/auth_high_count_logon_events.json

by editing x-pack/plugins/ml to x-pack/platform/plugins/shared/ml

[nastasha-solomon]

Unfortunately, it appears that links to many of the ML jobs and their datafeeds are broken because the source files were moved to different locations. I went through all of the links on the page and identified broken links in the following sections:

• Security: Authentication
• Security: CloudTrail
• Security: Host
• Security: Linux
• Security: Network
• Security: Packetbeat
• Security: Windows

These links are likely broken in 8.19 as well. ^

It looks as though the Security anomaly detection configurations page is manually maintained (as opposed to auto-generated), so the next steps are to update the file paths of all the broken references. Using the auth_high_count_logon_events job as an example, the reference to the source file for the job should be updated to:

https://github.com/elastic/kibana/blob/{branch}/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/security_auth/ml/auth_high_count_logon_events.json

And the reference to the job's datafeed should be updated to:

https://github.com/elastic/kibana/blob/{branch}/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/security_auth/ml/auth_high_count_logon_events.json

[nastasha-solomon]

Couple of additional notes from my link testing:

• Throughout the page, links to the manifest file are broken. The correct reference is:
  https://github.com/elastic/kibana/blob/{branch}/x-pack/platform/plugins/shared/ml/server/models/data_recognizer/modules/security_auth/manifest.json
• @peteharverson I'm unsure if the following refs are correct or if they should be pointing to a different page (e.g., docs about data sources for Elasticsearch):
  • https://github.com/elastic/stack-docs/blob/da58a8ff6172e901dbed033d049a0f5b824c1b08/docs/en/stack/ml/anomaly-detection/ootb-ml-jobs-siem.asciidoc?plain=1#L27
  • https://github.com/elastic/stack-docs/blob/da58a8ff6172e901dbed033d049a0f5b824c1b08/docs/en/stack/ml/anomaly-detection/ootb-ml-jobs-siem.asciidoc?plain=1#L260C122-L260C153