Entity risk scoring requirements

Elastic Stack Serverless Security

This page covers the requirements and guidelines for using the entity risk scoring, asset criticality, and entity store features, as well as their known limitations.

To use these features in Elastic Stack, your role must have certain cluster, index, and Kibana privileges. In Serverless, you need the appropriate user roles or a custom role with the right privileges.

In Elastic Stack, these features require a Platinum subscription or higher. In Serverless, they require the Security Analytics Complete project feature.

To install or run the risk scoring engine, you need the following:

• In Elastic Stack, you need the appropriate privileges.
• In Serverless, you need either the appropriate predefined Security user role or a custom role with the right privileges.

Serverless

Elastic Stack

Follow these guidelines to ensure clusters have adequate memory to handle data volume:

• With 2GB of Java Virtual Machine (JVM) heap memory, the risk scoring engine can safely process around 44 million documents, or 30 days of risk data with an ingest rate of 1000 documents per minute.
• With 1GB of JVM heap, the risk scoring engine can safely process around 20 million documents, or 30 days of risk data with an ingest rate of around 450 documents per minute.

• The risk scoring engine uses an internal user role to score all hosts, users, and services, and doesn’t respect privileges applied to custom users or roles. After you turn on the risk scoring engine for a Kibana space, all alerts in the space will contribute to host, user, and service risk scores.
• You cannot customize alert data views or risk weights associated with alerts and asset criticality levels.

To use asset criticality, you need the following:

• In Elastic Stack, you need the appropriate privileges for the .asset-criticality.asset-criticality-<space-id> index.
• In Serverless, you need either the appropriate predefined Security user role or a custom role with the right privileges for the .asset-criticality.asset-criticality-<space-id> index.

Serverless

To turn on the entity store, you need the following:

• In Elastic Stack, you need the appropriate privileges.
• In serverless, you need either the Admin role or a custom role with the right privileges.

• manage_enrich
• manage_index_templates
• manage_ingest_pipelines
• manage_transform

• read and view_index_metadata for .asset-criticality.asset-criticality-*
• read and manage for risk-score.risk-score-*
• read and manage for .entities.v1.latest.*
• read and view_index_metadata for all Elastic Security indices

All for the Security and Saved Objects Management features