Feedback:

fit IsolationForest

Use the IsolationForest operator to catch anomalous behavior, based on an unsupervised anomaly-detection algorithm optimized for high-volume event data. Instead of profiling normal behavior, it focuses on isolating anomalies. Because outliers are rare and different, they require fewer random splits in a tree structure to isolate, leading to a shorter average path length.

Syntax

fit IsolationForest [option_name=value] <fields_to_use> [into '<model_name>']

[option_name]=[value]

Specify model configuration parameters. All scikit-learn parameters are supported (e.g., n_estimators, contamination, bootstrap, random_state).

  • n_estimators

  • contamination

  • bootstrap

  • random_state

For information on the model parameters, refer to scikit learn documentation:

https://scikit-learn.org/stable/modules/generated/sklearn.ensemble.IsolationForest.html

<fields_to_use> One or more numeric fields used as model input.
into Specify the into keyword to store the learned model in an artifact that can later be applied to new search results with the apply operator.
'<model_name>'

Specify the name of the model to save as an artifact, so that it can be used with the apply operator. The model name must be wrapped with single or double straight quotation marks.

How IsolationForest Works

The IsolationForest model builds a collection of random isolation trees:

  1. A random feature is selected.

  2. A random split point for that feature is chosen.

  3. The dataset is recursively partitioned until each observation is isolated.

Anomalous points, being easier to isolate, will have shorter average path lengths across the forest.

The model outputs two key values:

  • Anomaly Score: A continuous severity score, wherein a higher score indicates a more anomalous record.

  • Prediction: A binary label indicating if the record is anomalous or not.

These values can then be used for alerting, dashboarding, and downstream investigations.

Usage

Note: The model will be deleted if it is not used for 90 days.

You can use the IsolationForest algorithm to isolate anomalies. Because outliers are rare and different, they require fewer random splits in a tree structure to isolate, supporting you in anomaly detection within AQL workflows.

This approach makes IsolationForest:

  • Effective for detecting unusual spikes or dips in event counts

  • Scalable to large security datasets

  • Useful for catching rare but meaningful deviations in behavior

Usage Recommendation

  • IsolationForest does not understand random strings, JSON, or high-cardinality categorical fields unless appropriately transformed.

  • Models trained on fewer than a few hundred rows may produce unstable results.

  • IsolationForest detects statistical anomalies, not malicious intent. Analysts should, therefore, confirm anomalies before escalating.

  • High anomalies may still be benign (expected spikes).

  • Use lower contamination values to avoid noise. 0.01–0.05 is typical for security datasets.

Examples

The follwing example trains an IsolationForest model on user activity and MFA-failure patterns to identify statistically unusual authentication behavior.

Step 1: Train a model on aggregated event counts

Copy 
| aggr count as cnt by sourcetype
| fit IsolationForest n_estimators=50 contamination=0.2 random_state=42 bootstrap=true cnt

Step 2: Train and save the model

Copy 
| aggr count as cnt by sourcetype
| fit IsolationForest n_estimators=50 contamination=0.2 random_state=42 bootstrap=true cnt into "iso_model"

Step 3: Apply the saved model

Copy 
| aggr count as cnt by sourcetype
| apply iso_model cnt