how to customize the mltk model predefined in escu rules

[lily]

Hi, I am lily.

I want to know how to customize the MLTK model using in ESCU rules.

If it doesn't, it is possible to check the contents of models inside the MLTK?  

<example>
I want to know how 'count_by_http_method_by_src_1d' was made

[Ismail_BSA]

I am also interested by this question 

[hl]

Same , I see that there are missing models also. When I event went to the ONNX github I still can't find the models that the splunk query is using for the mltk. 

```

| tstats `summariesonly` dc(All_Traffic.src) as src_count,count as total_count from datamodel=Network_Traffic.All_Traffic | apply app:network_traffic_src_count_30m [|`get_qualitative_upper_threshold(extreme)`] | apply app:network_traffic_count_30m [|`get_qualitative_upper_threshold(extreme)`] | search "IsOutlier(src_count)"=1 OR "IsOutlier(total_count)"=1

```

Where is this located  ?