Problem to use ML toolkit "apply" command in ES correlation search

[sonny_monti]

I want to use a ML toolkit trained model in Enterprise security.

To do this I want to use the "apply" command in a correlation search, which should use the trained model.

THe model is shared globally, the "apply" command is also shared globally.

When I save the new correlation search I get an error that says that the "apply" command was not found.

Any Idea why this happens?

[kchamplin_splun]

ES, on versions prior to 5.3, used a feature called "app imports". You need to add the app's name (as it appears on disk in etc/apps) to the app imports regex - documentation is here:
https://docs.splunk.com/Documentation/ES/5.2.2/Install/ImportCustomApps#Import_add-ons_with_a_differ...

This is also documented with Enterprise Security Content Updates:
https://docs.splunk.com/Documentation/ESSOC/1.0.38/user/ConfigureMLTKforusewithES

[sonny_monti · Accepted solution]

I drilled down in splunk answers and i found This anwer from muebel.
https://answers.splunk.com/answers/509868/commands-not-usable-from-enterprise-security.html
The answer from muebel resolved my problem.
ES has a modular input to control what is allowed in the app context. Just add the ML toolkit in the allowed imports.