Entity risk scoring

1. Risk scoring runs hourly to aggregate Open and Acknowledged alerts from the last 30 days, including building block alerts. Up to 10,000 alerts are processed per entity.

   Note

   • Starting in 9.4, only entities that exist in the entity store receive a risk score. Alerts referencing entities not in the entity store do not contribute to any risk score.

   • By default, only Open and Acknowledged alerts are included. When turning on risk scoring, you can choose to also include Closed alerts and apply additional KQL filters. Entities with no alerts that match the configured filters are not assigned a risk score.

   • By default, risk scoring uses the last 30 days of alerts. When turning on risk scoring, you can configure a different date and time range.

2. Alert risk scores (kibana.alert.risk_score) are aggregated for each entity, with entities identified by their Entity Unique Identifier (EUID) — a stable ID derived from ECS identity fields. Alerts with higher risk scores contribute more than those with lower risk scores. The resulting aggregated risk score is assigned to the Alerts category in the entity's risk summary.

3. The score is then updated based on the following risk inputs:

   • Asset criticality: If there is no asset criticality assigned, the entity risk score remains equal to the aggregated score from the Alerts category. If a criticality level is assigned, the risk score is calculated based on the default risk weight for each criticality level. This risk input is assigned to the Asset Criticality category in the entity's risk summary.

     Asset criticality level	Default risk weight
     Low impact	0.5
     Medium impact	1
     High impact	1.5
     Extreme impact	2

     Note

     Asset criticality levels and default risk weights are subject to change.

   • Watchlist membership: If an entity is a member of one or more watchlists, each watchlist's configured risk weighting is applied using a Bayesian update model. This risk input is assigned to the Watchlist category in the entity's risk summary.

4. Based on all risk inputs, a single entity risk score of 0-100 is generated. A risk level is assigned by mapping the risk score to one of these levels:

   Risk level	Risk score
   Unknown	< 20
   Low	20-40
   Moderate	40-70
   High	70-90
   Critical	> 90

When an entity belongs to a resolution group, a Resolution group risk score is produced in addition to the entity's individual score. Resolution scoring works as follows:

• Alert aggregation: All alerts from all members of a resolution group are combined and scored together, producing a single resolution group score. This score will typically be higher than any individual member's base score because it incorporates alerts from multiple entity records.
• Watchlist membership: The resolution group score includes watchlist membership from all members of the group (union of all watchlists).
• Asset criticality: The resolution group score uses the highest asset criticality value from any member of the group.
• Related entities: The resolution group score includes a list of the contributing entity aliases in the group.

1. The risk scoring engine runs hourly to aggregate Open and Acknowledged alerts from the last 30 days, including building block alerts. For each entity, the engine processes up to 10,000 alerts.

   Note

   • By default, only Open and Acknowledged alerts are included. When turning on risk scoring, you can choose to also include Closed alerts and apply additional KQL filters. Entities with no alerts that match the configured filters are not assigned a risk score.

   • By default, risk scoring uses the last 30 days of alerts. When turning on risk scoring, you can configure a different date and time range.

2. The engine groups alerts by host.name, user.name, or service.name, and aggregates the individual alert risk scores (kibana.alert.risk_score) such that alerts with higher risk scores contribute more than alerts with lower risk scores. The resulting aggregated risk score is assigned to the Alerts category in the entity's risk summary.

3. The engine then updates the score based on the following risk inputs:

   • Asset criticality: If there is no asset criticality assigned, the entity risk score remains equal to the aggregated score from the Alerts category. If a criticality level is assigned, the engine calculates the risk score based on the default risk weight for each criticality level. This risk input is assigned to the Asset Criticality category in the entity's risk summary.

     Asset criticality level	Default risk weight
     Low impact	0.5
     Medium impact	1
     High impact	1.5
     Extreme impact	2

     Note

     Asset criticality levels and default risk weights are subject to change.

   • Privileged user status: If a user has privileged user status, it increases the risk score based on the default risk weight. This risk input is assigned to the Privileged User category in the entity's risk summary.

     Privileged user status	Default risk weight
     Yes	2

4. Based on all risk inputs, the risk scoring engine generates a single entity risk score of 0-100. It assigns a risk level by mapping the risk score to one of these levels:

   Risk level	Risk score
   Unknown	< 20
   Low	20-40
   Moderate	40-70
   High	70-90
   Critical	> 90