You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/advanced-entity-analytics/analyze-risk-score-data.asciidoc
+2Lines changed: 2 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -18,6 +18,8 @@ TIP: We recommend that you prioritize <<alert-triaging, alert triaging>> to iden
18
18
19
19
From the Entity Analytics dashboard, you can access entity key performance indicators (KPIs), risk scores, and levels. You can also click the number link in the **Alerts** column to investigate and analyze the alerts on the Alerts page.
20
20
21
+
If you have enabled the <<entity-store, entity store>>, the dashboard also displays the <<entity-entities, **Entities** section>>, where you can view all hosts and users along with their risk and asset criticality data.
Copy file name to clipboardExpand all lines: docs/advanced-entity-analytics/asset-criticality.asciidoc
+6-1Lines changed: 6 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,7 +4,7 @@
4
4
.Requirements
5
5
[sidebar]
6
6
--
7
-
To view and assign asset criticality, you must have the appropriate user role. For more information, refer to <<ers-requirements, Entity risk scoring prerequisites>>.
7
+
To view and assign asset criticality, you must have the appropriate user role. For more information, refer to <<ers-requirements, Entity risk scoring requirements>>.
8
8
--
9
9
10
10
The asset criticality feature allows you to classify your organization's entities based on various operational factors that are important to your organization. Through this classification, you can improve your threat detection capabilities by focusing your alert triage, threat-hunting, and investigation activities on high-impact entities.
image::images/assign-asset-criticality-timeline.png[Assign asset criticality from the host details flyout in Timeline]
46
46
47
+
If you have enabled the <<entity-store, entity store>>, you can also view asset criticality assignments in the <<entity-entities, **Entities** section>> of the Entity Analytics dashboard:
To use the entity store, you must have the appropriate privileges. For more information, refer to <<ers-requirements, Entity risk scoring requirements>>.
10
+
--
11
+
12
+
The entity store allows you to query, reconcile, maintain, and persist entity metadata such as:
13
+
14
+
* Ingested log data
15
+
* Data from integrated identity providers (such as Active Directory, EntraID, and Okta)
16
+
* Data from internal and external alerts
17
+
* External asset repository data
18
+
* Asset criticality data
19
+
* Entity risk score data
20
+
21
+
The entity store can hold any entity type observed by {elastic-sec}. It allows you to view and query select entities represented in your indices without needing to perform real-time searches of observable data. The entity store extracts entities from all indices in the {elastic-sec} <<default-data-view-security, default data view>>.
22
+
23
+
When the entity store is enabled, the following resources are generated for each entity type (hosts and users):
24
+
25
+
* {es} resources, such as transforms, ingest pipelines, and enrich policies.
26
+
* Data and fields for each entity.
27
+
* The `.entities.v1.latest.security_user_<space-id>` and `.entities.v1.latest.security_host_<space-id>` indices, which contain field mappings for hosts and users respectively. You can query these indices to see a list of fields that are mapped in the entity store.
28
+
29
+
[discrete]
30
+
[[enable-entity-store]]
31
+
== Enable entity store
32
+
33
+
To enable the entity store:
34
+
35
+
. Find **Entity Store** in the navigation menu or by using the {kibana-ref}/introduction.html#kibana-navigation-search[global search field].
36
+
. On the **Entity Store** page, turn the toggle on.
37
+
38
+
Once you enable the entity store, the Entity Analytics dashboard displays the <<entity-entities, **Entities**>> section.
39
+
40
+
[discrete]
41
+
[[clear-entity-store]]
42
+
== Clear entity store data
43
+
44
+
Once the entity store is enabled, you may want to clear the stored data and start fresh. For example, if you normalized the `user.name` or `host.name` fields, clearing the entity store data would allow you to repopulate the entity store with the updated, normalized values. This action removes all previously extracted entity information, enabling new data extraction and analysis.
45
+
46
+
Clearing entity store data does not delete your source data, assigned entity risk scores, or asset criticality assignments.
47
+
48
+
CAUTION: Clearing entity store data permanently deletes persisted user and host records, and data is no longer available for analysis. Proceed with caution, as this cannot be undone.
49
+
50
+
To clear entity data:
51
+
52
+
. Find **Entity Store** in the navigation menu or by using the {kibana-ref}/introduction.html#kibana-navigation-search[global search field].
Copy file name to clipboardExpand all lines: docs/advanced-entity-analytics/ers-req.asciidoc
+31-2Lines changed: 31 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,9 +1,9 @@
1
1
[[ers-requirements]]
2
2
= Entity risk scoring requirements
3
3
4
-
To use entity risk scoring and asset criticality, your role must have certain cluster, index, and {kib} privileges. These features require a https://www.elastic.co/pricing[Platinum subscription] or higher.
4
+
To use entity risk scoring, asset criticality, and entity store, your role must have certain cluster, index, and {kib} privileges. These features require a https://www.elastic.co/pricing[Platinum subscription] or higher.
5
5
6
-
This page covers the requirements and guidelines for using the entity risk scoring and asset criticality features, as well as their known limitations.
6
+
This page covers the requirements and guidelines for using the entity risk scoring, asset criticality, and entity store features, as well as their known limitations.
7
7
8
8
[discrete]
9
9
== Entity risk scoring
@@ -65,4 +65,33 @@ To use asset criticality, you need the following privileges for the `.asset-crit
65
65
| Unassign asset criticality
66
66
| `delete`
67
67
68
+
|==============================================
69
+
70
+
[discrete]
71
+
== Entity store
72
+
73
+
[discrete]
74
+
=== Privileges
75
+
76
+
To use the entity store, you need the following privileges:
77
+
78
+
[discrete]
79
+
[width="100%",options="header"]
80
+
|==============================================
81
+
82
+
| Cluster | Index | {kib}
83
+
a|
84
+
* `manage_enrich`
85
+
* `manage_index_templates`
86
+
* `manage_ingest_pipelines`
87
+
* `manage_transform`
88
+
89
+
a|
90
+
* `read` and `view_index_metadata` for `.asset-criticality.asset-criticality-*`
91
+
* `read` and `manage` for `risk-score.risk-score-*`
92
+
* `read` and `manage` for `.entities.v1.latest.*`
93
+
* `read` and `view_index_metadata` for all {elastic-sec} indices
94
+
95
+
| **All** for the **Security** and **Saved Objects Management** features
Copy file name to clipboardExpand all lines: docs/advanced-entity-analytics/turn-on-risk-engine.asciidoc
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,7 +3,7 @@
3
3
4
4
beta[]
5
5
6
-
IMPORTANT: To use entity risk scoring, your role must have the appropriate privileges. For more information, refer to <<ers-requirements, Entity risk scoring prerequisites>>.
6
+
IMPORTANT: To use entity risk scoring, your role must have the appropriate privileges. For more information, refer to <<ers-requirements, Entity risk scoring requirements>>.
Displays the total number of critical hosts, critical users, and anomalies. Select a link to jump to the Host risk table, User risk table, or Anomalies table.
30
+
Displays the total number of critical hosts, critical users, and anomalies. Select a link to jump to the **Hosts** page, **Users** page, or **Anomalies** table.
31
+
32
+
[[entity-user-risk-scores]]
33
+
[float]
34
+
== User Risk Scores
35
+
36
+
.Requirements
37
+
[sidebar]
38
+
--
39
+
To display user risk scores, you must <<turn-on-risk-engine, turn on the risk scoring engine>>.
40
+
--
41
+
42
+
Displays user risk score data for your environment, including the total number of users, and the five most recently recorded user risk scores, with their associated user names, risk data, and number of detection alerts. Like host risk scores, user risk scores are calculated using a weighted sum on a scale of 0 (lowest) to 100 (highest).
Interact with the table to filter data, view more details, and take action:
48
+
49
+
* Select the *User risk level* menu to filter the chart by the selected level.
50
+
* Click a user name link to open the user details flyout.
51
+
* Hover over a user name link to display inline actions: *Add to timeline*, which adds the selected value to Timeline, and *Copy to Clipboard*, which copies the user name value for you to paste later.
52
+
* Click *View all* in the upper-right to display all user risk information on the Users page.
53
+
* Click the number link in the *Alerts* column to view the alerts on the Alerts page. Hover over the number and select *Investigate in timeline* (image:images/timeline-button-osquery.png[Investigate in timeline icon,20,20]) to launch Timeline with a query that includes the associated user name value.
54
+
55
+
For more information about user risk scores, refer to <<entity-risk-scoring>>.
32
56
33
57
[[entity-host-risk-scores]]
34
58
[float]
35
59
== Host Risk Scores
36
60
61
+
.Requirements
62
+
[sidebar]
63
+
--
64
+
To display host risk scores, you must <<turn-on-risk-engine, turn on the risk scoring engine>>.
65
+
--
66
+
37
67
Displays host risk score data for your environment, including the total number of hosts, and the five most recently recorded host risk scores, with their associated host names, risk data, and number of detection alerts. Host risk scores are calculated using a weighted sum on a scale of 0 (lowest) to 100 (highest).
38
68
39
69
[role="screenshot"]
@@ -50,24 +80,42 @@ Interact with the table to filter data, view more details, and take action:
50
80
51
81
For more information about host risk scores, refer to <<entity-risk-scoring>>.
52
82
53
-
[[entity-user-risk-scores]]
83
+
[[entity-entities]]
54
84
[float]
55
-
== User Risk Scores
85
+
== Entities
56
86
57
-
Displays user risk score data for your environment, including the total number of users, and the five most recently recorded user risk scores, with their associated user names, risk data, and number of detection alerts. Like host risk scores, user risk scores are calculated using a weighted sum on a scale of 0 (lowest) to 100 (highest).
87
+
preview::[]
88
+
89
+
.Requirements
90
+
[sidebar]
91
+
--
92
+
To display the **Entities** section, you must <<enable-entity-store,enable the entity store>>.
93
+
--
94
+
95
+
The **Entities** section provides a centralized view of all hosts and users in your environment. It displays entities from the <<entity-store, entity store>>, which meet any of the following criteria:
96
+
97
+
* Have been observed by {elastic-sec}
98
+
* Have an asset criticality assignment
99
+
* Have been added to {elastic-sec} through an integration, such Active Directory or Okta
100
+
101
+
NOTE: The **Entities** table only shows a subset of the data available for each entity. You can query the `.entities.v1.latest.security_user_<space-id>` and `.entities.v1.latest.security_host_<space-id>` indices to see all the fields for each entity in the entity store.
Interact with the table to filter data, view more details, and take action:
106
+
Entity data from different sources appears in the **Entities** section based on the following timelines:
63
107
64
-
* Select the *User risk level* menu to filter the chart by the selected level.
65
-
* Click a user name link to open the user details flyout.
66
-
* Hover over a user name link to display inline actions: *Add to timeline*, which adds the selected value to Timeline, and *Copy to Clipboard*, which copies the user name value for you to paste later.
67
-
* Click *View all* in the upper-right to display all user risk information on the Users page.
68
-
* Click the number link in the *Alerts* column to view the alerts on the Alerts page. Hover over the number and select *Investigate in timeline* (image:images/timeline-button-osquery.png[Investigate in timeline icon,20,20]) to launch Timeline with a query that includes the associated user name value.
108
+
* When you first enable the entity store, only data stored in the last 24 hours is processed. After that, data is processed continuously.
109
+
* Observed events from the {elastic-sec} default data view are processed in near real-time.
110
+
* Entity Analytics data, such as entity risk scores and asset criticality (including bulk asset criticality upload), is also processed in near real-time.
111
+
* The availability of entities extracted from Entity Analytics integrations depends on the specific integration. Refer to {integrations-docs}/entityanalytics_ad[Active Directory Entity Analytics], {integrations-docs}/entityanalytics_entra_id[Microsoft Entra ID Entity Analytics], and {integrations-docs}/entityanalytics_okta[Okta Entity Analytics] for more details.
69
112
70
-
For more information about user risk scores, refer to <<entity-risk-scoring>>.
113
+
Interact with the table to filter data and view more details:
114
+
115
+
* Select the **Risk level** dropdown to filter the table by the selected user or host risk level.
116
+
* Select the **Criticality** dropdown to filter the table by the selected asset criticality level.
117
+
* Select the **Source** dropdown to filter the table by the data source.
118
+
* Click the **View details** icon (image:detections/images/view-details-icon.png[View details icon,16,15]) to open the entity details flyout.
![mergify[bot]](https://avatars.githubusercontent.com/in/10562?v=4&size=40){kind=avatar}
0 commit comments