This documentation contains work-in-progress information for future Elastic Stack and Cloud releases. Use the version selector to view supported release docs. It also contains some Elastic Cloud serverless information. Check out our serverless docs for more details.

« Entity risk scoring Turn on the risk scoring engine »

› › ›

Entity risk scoring requirements

edit

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Entity risk scoring requirements

edit

To use entity risk scoring, asset criticality, and entity store, your role must have certain cluster, index, and Kibana privileges. These features require a Platinum subscription or higher.

This page covers the requirements and guidelines for using the entity risk scoring, asset criticality, and entity store features, as well as their known limitations.

Entity risk scoring

edit

Privileges

edit

To install or run the risk scoring engine, you need the following privileges:

Action	Cluster privileges	Index privileges	Kibana privileges
Install the risk engine	`manage_index_templates` `manage_transform` `manage_ingest_pipelines`	`all` privilege for `risk-score.risk-score-*`	Read for the Security feature
Run the risk engine	`manage_transform`	N/A	Read for the Security feature

Elasticsearch resource guidelines

edit

Follow these guidelines to ensure clusters have adequate memory to handle data volume:

With 2GB of Java Virtual Machine (JVM) heap memory, the risk scoring engine can safely process around 44 million documents, or 30 days of risk data with an ingest rate of 1000 documents per minute.
With 1GB of JVM heap, the risk scoring engine can safely process around 20 million documents, or 30 days of risk data with an ingest rate of around 450 documents per minute.

Known limitations

edit

The risk scoring engine uses an internal user role to score all hosts, users, and services, and doesn’t respect privileges applied to custom users or roles. After you turn on the risk scoring engine for a Kibana space, all alerts in the space will contribute to host, user, and service risk scores.

Asset criticality

edit

Privileges

edit

To use asset criticality, you need the following privileges for the .asset-criticality.asset-criticality-<space-id> index:

Action	Index privilege
View asset criticality	`read`
View, assign, or change asset criticality	`read` and `write`
Unassign asset criticality	`delete`

Entity store

edit

Privileges

edit

To use the entity store, you need the following privileges:

Cluster	Index	Kibana
`manage_enrich` `manage_index_templates` `manage_ingest_pipelines` `manage_transform`	`read` and `view_index_metadata` for `.asset-criticality.asset-criticality-` `read` and `manage` for `risk-score.risk-score-` `read` and `manage` for `.entities.v1.latest.*` `read` and `view_index_metadata` for all Elastic Security indices	All for the Security and Saved Objects Management features

« Entity risk scoring Turn on the risk scoring engine »