anchor.diff:  Each bucket has an `anomaly_score`, which is a statistically aggregated and
   normalized view of the combined anomalousness of all record results within each bucket.
   
  -One bucket result is written for each `bucket_span` for each job, even if it is not considered to be anomalous 
  +One bucket result is written for each `bucket_span` for each job, even if it is not considered to be anomalous
   (when it will have an `anomaly_score` of zero).
   
   Upon identifying an anomalous bucket, you can investigate further by either
  
positive.code: 
  For example, if analyzing unusual bytes sent and unusual domains visited, if user_name was
  specified as the influencer, then an 'influencer_score' for each anomalous user_name would be written per bucket.
  E.g. If `user_name: Bob` had an `influencer_score` > 75, 
  then `Bob` would be considered very anomalous during this time interval in either or both of those attack vectors.
  
  One `influencer` result is written per bucket for each influencer that is considered anomalous.
  
negative.code: [[ml-results-categories]]
  ===== Categories
  
  When `categorization_field_name` is specified in the job configuration,
  it is possible to view the definitions of the resulting categories.
  A category definition describes the common terms matched and contains examples of matched values.
  
  The anomaly results from a categorization analysis are available as _buckets_, _influencers_ and _records_ results.
  