List anomaly detectors
malcolm_anomaly_detectorsRead-only
List OpenSearch anomaly detectors with modeled features and anomaly counts. Use it to see if machine-learning baselines have flagged unusual activity.
Instructions
List OpenSearch anomaly detectors, what each models, and whether any anomalies exist.
Use this to see what machine-learning baselines Malcolm is maintaining
over the traffic and whether they have produced anything. It counts
anomalies across every detector at once; for which entities one named
detector scored, and when, take its `id` to malcolm_anomaly_results.
This reads the detector configuration, not the traffic: for the
underlying documents use malcolm_search, and for Suricata's
signature-based alerts use malcolm_alerts, which is a different
detection method entirely.
Returns JSON {"total", "showing", "recorded_anomalies", "detectors"};
per-detector fields are in the output schema, minus the aggregation
definitions behind each feature, which are configuration detail.
`recorded_anomalies` counts anomalous results across all detectors, NOT
detector runs. Zero with detectors configured still needs care: a
detector that was never started produces the same zero.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max detectors to return. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |