[DRAFT] [ML Package] Privileged Access Detection

packages/privileged_access/changelog.yml

@@ -0,0 +1,6 @@
+# newer versions go on top
+- version: "0.0.1"
+  changes:
+    - description: Initial release of the package
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/####

packages/privileged_access/docs/README.md

@@ -0,0 +1,15 @@
+# Privileged Access Detection
+
+<!-- TODO: Overview -->
+
+## Installation
+
+## Anomaly Detection Jobs 
+
+| Job                                               | Description                                                                                     |
+|---------------------------------------------------|-------------------------------------------------------------------------------------------------|                        |
+
+
+## Licensing
+
+Usage in production requires that you have a license key that permits use of machine learning features.

packages/privileged_access/elasticsearch/transform/pivot_transform/fields/fields.yml

@@ -0,0 +1,14 @@
+- name: host.name
+  type: keyword
+- name: user.name
+  type: keyword
+- name: privilege_type
+  type: keyword
+- name: event.action
+  type: keyword
+- name: event.code
+  type: keyword
+- name: event.category
+  type: keyword
+- name: '@timestamp'
+  type: date

packages/privileged_access/elasticsearch/transform/pivot_transform/transform.yml

@@ -0,0 +1,60 @@
+source:
+  index: "logs-*"
+  query:
+    bool:
+      filter:
+        - range:
+              '@timestamp':
+                gte: now-1M
+        - exists:
+            field: winlog.event_data.PrivilegeList
+        - terms:
+            'host.os.type': ["windows","Windows"]
+        - terms:
+            'event.action': ["logged-in-special","privileged-service-called","privileged-operation"]
+        - terms:
+            'winlog.event_data.PrivilegeList': ["SeDebugPrivilege","SeTakeOwnershipPrivilege","SeBackupPrivilege", "SeRestorePrivilege","SeImpersonatePrivilege","SeAssignPrimaryTokenPrivilege"]
+dest:
+  index: ml_privilege_type_ped-0.0.1
+  aliases:
+    - alias: ml_privilege_type_ped.latest
+      move_on_creation: true
+    - alias: ml_privilege_type_ped.all
+      move_on_creation: false
+description: This transform runs hourly and collects special privileges assigned to an user in Windows events for Privilege Escalation Detection package.
+frequency: 1h
+pivot:
+  aggregations:
+    '@timestamp':
+      max:
+        field: '@timestamp'
+  group_by:
+    'host.name':
+      terms:
+        field: host.name
+    'user.name':
+      terms:
+        field: user.name
+    'privilege_type':
+      terms:
+        field: winlog.event_data.PrivilegeList
+    'event.action':
+      terms:
+        field: event.action
+    'event.category':
+      terms:
+        field: event.category
+    'event.code':
+      terms:
+        field: event.code
+settings:
+  # This is required to prevent the transform from clobbering the Fleet-managed mappings.
+  deduce_mappings: false
+  unattended: true
+sync:
+  time:
+    delay: 60s
+    field: '@timestamp'
+_meta:
+  fleet_transform_version: 0.0.1
+  run_as_kibana_system: false