Entity risk scoring requirements

This page covers the requirements and guidelines for using the entity risk scoring, asset criticality, and entity store features, as well as their known limitations.

To use these features in Elastic Stack, your role must have certain cluster, index, and Kibana privileges. In serverless, you need the appropriate user roles or a custom role with the right privileges.

In Elastic Stack, these features require a Platinum subscription or higher. In serverless, they require the Security Analytics Complete project feature.

To turn on the risk scoring engine, you need the following:

• In Elastic Stack, you need the appropriate privileges.
• In serverless, you need either the appropriate predefined Security user role or a custom role with the right privileges.

• manage_index_templates
• manage_transform

All privilege for risk-score.risk-score-*

Read for the Security feature

• Platform engineer
• Detections admin
• Admin

Elastic Stack

Follow these guidelines to ensure clusters have adequate memory to handle data volume:

• With 2GB of Java Virtual Machine (JVM) heap memory, the risk scoring engine can safely process around 44 million documents, or 30 days of risk data with an ingest rate of 1000 documents per minute.
• With 1GB of JVM heap, the risk scoring engine can safely process around 20 million documents, or 30 days of risk data with an ingest rate of around 450 documents per minute.

• The risk scoring engine uses an internal user role to score all hosts and users, and doesn’t respect privileges applied to custom users or roles. After you turn on the risk scoring engine for a Kibana space, all alerts in the space will contribute to host and user risk scores.
• You cannot customize alert data views or risk weights associated with alerts and asset criticality levels.

To use asset criticality, you need the following:

• In Elastic Stack, you need the appropriate privileges for the .asset-criticality.asset-criticality-<space-id> index.
• In serverless, you need either the appropriate predefined Security user role or a custom role with the right privileges for the .asset-criticality.asset-criticality-<space-id> index.

To turn on the entity store, you need the following:

• In Elastic Stack, you need the appropriate privileges.
• In serverless, you need either the Admin role or a custom role with the right privileges.

• manage_enrich
• manage_index_templates
• manage_ingest_pipelines
• manage_transform

• read and view_index_metadata for .asset-criticality.asset-criticality-*
• read and manage for risk-score.risk-score-*
• read and manage for .entities.v1.latest.*
• read and view_index_metadata for all Elastic Security indices

All for the Security and Saved Objects Management features