https://community.splunk.com/t5/Splunk-Enterprise-Security/Problem-to-use-ML-toolkit-quot-apply-quot-command-in-ES/m-p/407025#M4740 <P>ES, on versions prior to 5.3, used a feature called "app imports". You need to add the app's name (as it appears on disk in etc/apps) to the app imports regex - documentation is here:<BR /> <A href="https://docs.splunk.com/Documentation/ES/5.2.2/Install/ImportCustomApps#Import_add-ons_with_a_different_naming_convention">https://docs.splunk.com/Documentation/ES/5.2.2/Install/ImportCustomApps#Import_add-ons_with_a_different_naming_convention</A></P> <P>This is also documented with Enterprise Security Content Updates:<BR /> <A href="https://docs.splunk.com/Documentation/ESSOC/1.0.38/user/ConfigureMLTKforusewithES">https://docs.splunk.com/Documentation/ESSOC/1.0.38/user/ConfigureMLTKforusewithES</A></P> Tue, 04 Jun 2019 15:15:38 GMT kchamplin_splun 2019-06-04T15:15:38Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Problem-to-use-ML-toolkit-quot-apply-quot-command-in-ES/m-p/407023#M4738 <P>I want to use a ML toolkit trained model in Enterprise security. </P> <P>To do this I want to use the "apply" command in a correlation search, which should use the trained model.</P> <P>THe model is shared globally, the "apply" command is also shared globally.</P> <P>When I save the new correlation search I get an error that says that the "apply" command was not found.</P> <P>Any Idea why this happens?</P> Tue, 04 Jun 2019 12:50:49 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Problem-to-use-ML-toolkit-quot-apply-quot-command-in-ES/m-p/407023#M4738 sonny_monti 2019-06-04T12:50:49Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Problem-to-use-ML-toolkit-quot-apply-quot-command-in-ES/m-p/407024#M4739 <P>I drilled down in splunk answers and i found <A href="https://answers.splunk.com/answers/509868/commands-not-usable-from-enterprise-security.html">This anwer from muebel</A>.<BR /> <A href="https://answers.splunk.com/answers/509868/commands-not-usable-from-enterprise-security.html">https://answers.splunk.com/answers/509868/commands-not-usable-from-enterprise-security.html</A><BR /> The answer from muebel resolved my problem. <BR /> ES has a modular input to control what is allowed in the app context. Just add the ML toolkit in the allowed imports.</P> Tue, 04 Jun 2019 13:41:01 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Problem-to-use-ML-toolkit-quot-apply-quot-command-in-ES/m-p/407024#M4739 sonny_monti 2019-06-04T13:41:01Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Problem-to-use-ML-toolkit-quot-apply-quot-command-in-ES/m-p/407025#M4740 <P>ES, on versions prior to 5.3, used a feature called "app imports". You need to add the app's name (as it appears on disk in etc/apps) to the app imports regex - documentation is here:<BR /> <A href="https://docs.splunk.com/Documentation/ES/5.2.2/Install/ImportCustomApps#Import_add-ons_with_a_different_naming_convention">https://docs.splunk.com/Documentation/ES/5.2.2/Install/ImportCustomApps#Import_add-ons_with_a_different_naming_convention</A></P> <P>This is also documented with Enterprise Security Content Updates:<BR /> <A href="https://docs.splunk.com/Documentation/ESSOC/1.0.38/user/ConfigureMLTKforusewithES">https://docs.splunk.com/Documentation/ESSOC/1.0.38/user/ConfigureMLTKforusewithES</A></P> Tue, 04 Jun 2019 15:15:38 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Problem-to-use-ML-toolkit-quot-apply-quot-command-in-ES/m-p/407025#M4740 kchamplin_splun 2019-06-04T15:15:38Z