diff --git a/docs/experimental-machine-learning/problem-child.md b/docs/experimental-machine-learning/problem-child.md index 26e943d05..ddb62fb60 100644 --- a/docs/experimental-machine-learning/problem-child.md +++ b/docs/experimental-machine-learning/problem-child.md @@ -61,4 +61,4 @@ You can optionally choose to refresh your index mapping from within Kibana: #### 4. Verify enrichment fields -Any documents corresponding to Windows process events should now be enriched with `problemchild.*` \ No newline at end of file +Any documents corresponding to Windows process events should now be enriched with `problemchild.*`. By default, the enrichment pipeline also consists of a script processor for a blocklist, so you might also see the field `blocklist_label` appear in documents that match the blocklist.