Host risk score

The host risk score feature highlights risky hosts from within your environment. It utilizes a transform with a scripted metric aggregation to calculate host risk scores based on alerts that were generated within the past five days. The transform runs hourly to update the score as new alerts are generated.

Each rule’s contribution to the host risk score is based on the rule’s risk score (signal.rule.risk_score) and a time decay factor to reduce the impact of stale alerts. The risk score is calculated using a weighted sum where rules with higher time-corrected risk scores also have higher weights. Each host risk score is normalized on a scale of 0 to 100.

Specific host attributes can boost the final risk score. For example, alert activity on a server poses a greater risk than that on a laptop. Therefore, the host risk score is 1.5 times higher if the host is a server. This boosted score is finalized after calculating the weighted sum of the time-corrected risks.

The following table shows how risk levels are applied to a host, based on the normalized risk score:

You can enable host risk score from the following places in the Elastic Security app:

Or, in Kibana, you can enable host risk score in Console.

To enable host risk score from the Entity Analytics dashboard:

To enable host risk score from the Hosts page:

To enable host risk score from a host’s details page:

To enable host risk score from Console in Kibana, open a browser window and enter the following URL:

{KibanaURL}/s/{spaceID}/app/dev_tools#/console?load_from={KibanaURL}/s/{spaceID}/internal/risk_score/prebuilt_content/dev_tool/enable_host_risk_score

If you previously enabled host risk score and are upgrading to Elastic Stack version 8.5 or later, there’ll be an Upgrade button for host risk score instead of Enable.

Before upgrading, note the following:

After this is done, you can proceed with upgrading the host risk score feature from any of the following places in the Elastic Security app:

It is recommended you analyze hosts with the highest risk scores first — those in the Critical and Moderate categories. Host risk score data appears in the following places in the Elastic Security app:

The host.risk.calculated_level column in the Alerts table:

The Overview tab on the Alert details flyout:

The Host risk classification column in the All hosts table on the Hosts page:

The Host risk tab on the Hosts page:

The Overview section on the host details page:

The Host risk tab on the host details page:

You can also visualize host risk score data using prebuilt dashboards that are automatically imported when the feature is enabled.

To access the dashboards:

In this example, we’ll explore the Drilldown of Host Risk Score dashboard.

Use the histogram to track how the risk score for a particular host has changed over time. To specify a date range, use the date and time picker, or drag and select a time range within the histogram.

To go to the host’s details page, click any host’s corresponding bar in the histogram, then select Go to Host View.

The histogram shows historical changes in a particular host’s risk score(s). To specify a date range, use the date and time picker, or drag and select a time range within the histogram.

During the installation or upgrade process, you may receive the following error messages:

In this case, we recommend that you manually delete the host risk score module, then re-enable it. To manually delete the module:

After manually deleting the host risk score saved objects, transforms, ingest pipeline, and stored scripts, follow the steps to re-enable the host risk score module.