IMPORTANT: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
current release documentation.
Entity risk scoring prerequisites
editEntity risk scoring prerequisites
editTo use entity risk scoring and asset criticality, your role must have certain cluster, index, and Kibana privileges. These features require a Platinum subscription or higher.
This page covers the requirements and guidelines for using the entity risk scoring and asset criticality features, as well as their known limitations.
Entity risk scoring
editPrivileges
editTo turn on the risk scoring engine, you need the following privileges:
Cluster | Index | Kibana |
---|---|---|
|
|
Read for the Security feature |
Elasticsearch resource guidelines
editFollow these guidelines to ensure clusters have adequate memory to handle data volume:
- With 2GB of Java Virtual Machine (JVM) heap memory, the risk scoring engine can safely process around 44 million documents, or 30 days of risk data with an ingest rate of 1000 documents per minute.
- With 1GB of JVM heap, the risk scoring engine can safely process around 20 million documents, or 30 days of risk data with an ingest rate of around 450 documents per minute.
Known limitations
edit- You can only enable the risk scoring engine in a single Kibana space within a cluster.
- The risk scoring engine uses an internal user role to score all hosts and users, and doesn’t respect privileges applied to custom users or roles. After you turn on the risk scoring engine for a Kibana space, all alerts in the space will contribute to host and user risk scores.
Asset criticality
editTo use the asset criticality feature, turn on the securitySolution:enableAssetCriticality
advanced setting.
Privileges
edit-
To view an entity’s asset criticality, you need the
read
privilege for the.asset-criticality.asset-criticality-<space-id>
index. -
To view, assign, or change an entity’s asset criticality, you need the
read
andwrite
privileges for the.asset-criticality.asset-criticality-<space-id>
index.
Known limitations
edit- You cannot disable asset criticality as a risk input. Once assigned, an asset criticality level can be changed but not unassigned.