You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
==== Triage alerts associated with high-risk or business-critical entities
52
53
53
-
To analyze alerts associated with high-risk entities, you can filter or group them by entity risk level.
54
+
To analyze alerts associated with high-risk or business-critical entities, you can filter or group them by entity risk level or asset criticality level.
54
55
55
-
* Use the drop-down filter controls to filter alerts by entity risk level. To do this, <<drop-down-filter-controls, edit the default controls>> to filter by `user.risk.calculated_level` or `host.risk.calculated_level`:
56
-
+
57
-
[role="screenshot"]
58
-
image::images/filter-by-host-risk-level.png[Alerts filtered by high host risk level]
56
+
NOTE: If you change the entity's criticality level after an alert is generated, that alert document will include the original criticality level and will not reflect the new criticality level.
57
+
58
+
* Use the drop-down filter controls to filter alerts by entity risk level or asset criticality level. To do this, <<drop-down-filter-controls, edit the default controls>> to filter by:
59
59
60
-
* To group alerts by entity risk level, select **Group alerts by**, then select **Custom field** and search for `host.risk.calculated_level` or `user.risk.calculated_level`.
60
+
** `user.risk.calculated_level` or `host.risk.calculated_level` for entity risk level:
61
61
+
62
62
[role="screenshot"]
63
-
image::images/group-by-host-risk-level.png[Alerts grouped by host risk levels]
63
+
image::images/filter-by-host-risk-level.png[Alerts filtered by high host risk level]
64
64
65
-
** You can further sort the grouped alerts by highest entity risk score:
66
-
+
67
-
--
68
-
... Expand a risk level group, for example **High**.
69
-
... Select **Sort fields** → **Pick fields to sort by**.
==== Triage alerts associated with business-critical entities
82
-
83
-
To analyze alerts associated with business-critical entities, you can filter or group them by entity asset criticality.
68
+
image::images/filter-by-asset-criticality.png[Filter alerts by asset criticality level]
84
69
85
-
NOTE: If you change the entity's criticality level after an alert is generated, that alert document will include the original criticality level and will not reflect the new criticality level.
70
+
* To group alerts by entity risk level or asset criticality level, select **Group alerts by**, then select **Custom field** and search for:
86
71
87
-
* Use the drop-down filter controls to filter alerts by asset criticality level. To do this, <<drop-down-filter-controls, edit the default controls>> to filter by `user.asset.criticality` or `host.asset.criticality`:
72
+
** `host.risk.calculated_level` or `user.risk.calculated_level` for entity risk level:
88
73
+
89
74
[role="screenshot"]
90
-
image::images/filter-by-asset-criticality.png[Filter alerts by asset criticality level]
75
+
image::images/group-by-host-risk-level.png[Alerts grouped by host risk levels]
91
76
92
-
* To group alerts by asset criticality level, select **Group alerts by**, then select **Custom field** and search for `host.asset.criticality` or `user.asset.criticality`.
77
+
** `host.asset.criticality` or `user.asset.criticality` for asset criticality level:
93
78
+
94
79
[role="screenshot"]
95
80
image::images/group-by-asset-criticality.png[Alerts grouped by entity asset criticality levels]
96
81
97
82
** You can further sort the grouped alerts by highest entity risk score:
98
83
+
99
84
--
100
-
... Expand an asset criticality group, for example **high_impact**.
85
+
... Expand a risk level group (for example, **High**) or an asset criticality group (for example, **high_impact**).
101
86
... Select **Sort fields** → **Pick fields to sort by**.
Copy file name to clipboardExpand all lines: docs/advanced-entity-analytics/asset-criticality.asciidoc
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -26,7 +26,7 @@ For example, you can assign **Extreme impact** to business-critical entities, or
26
26
[discrete]
27
27
== View and assign asset criticality
28
28
29
-
Entities do not have a default asset criticality level. You can view, assign, and change asset criticality from the following places in the {elastic-sec} app:
29
+
Entities do not have a default asset criticality level. You can view, assign, change, or unassign asset criticality from the following places in the {elastic-sec} app:
30
30
31
31
* The <<host-details-page, host details page>> and <<user-details-page, user details page>>:
32
32
+
@@ -57,7 +57,7 @@ With asset criticality, you can improve your security operations by:
57
57
58
58
You can use asset criticality as a prioritization factor when triaging alerts and conducting investigations and response activities.
59
59
60
-
Once you assign a criticality level to an entity, all subsequent alerts related to that entity are enriched with its criticality level. This additional context allows you to <<triage-alerts-associated-with-business-critical-entities, prioritize alerts associated with high-impact entities>>.
60
+
Once you assign a criticality level to an entity, all subsequent alerts related to that entity are enriched with its criticality level. This additional context allows you to <<triage-alerts-associated-with-high-risk-or-business-critical-entities, prioritize alerts associated with business-critical entities>>.
Copy file name to clipboardExpand all lines: docs/advanced-entity-analytics/entity-risk-scoring.asciidoc
+15-9Lines changed: 15 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,8 +14,14 @@ It also generates risk scores on a recurring interval, and allows for easy onboa
14
14
15
15
Entity risk scores are determined by the following risk inputs:
16
16
17
-
* <<alerts-ui-manage, Alerts>>, stored in the `.alerts-security.alerts-<space-id>` index alias
18
-
* <<asset-criticality, Asset criticality level>>, stored in the `.asset-criticality.asset-criticality-<space-id>` index alias
17
+
[width="100%",options="header"]
18
+
|==============================================
19
+
|Risk input |Storage location
20
+
21
+
|<<alerts-ui-manage, Alerts>> |`.alerts-security.alerts-<space-id>` index alias
22
+
|<<asset-criticality, Asset criticality level>> |`.asset-criticality.asset-criticality-<space-id>` index alias
23
+
|==============================================
24
+
19
25
20
26
The resulting entity risk scores are stored in the `risk-score.risk-score-<space-id>` data stream alias.
21
27
@@ -29,10 +35,12 @@ The resulting entity risk scores are stored in the `risk-score.risk-score-<space
29
35
[[how-is-risk-score-calculated]]
30
36
== How is risk score calculated?
31
37
32
-
The risk scoring engine runs hourly to aggregate `Open` and `Acknowledged` alerts from the last 30 days. For each entity, the engine processes up to 10,000 alerts. It groups alerts by `host.name` or `user.name`, and aggregates the individual alert risk scores (`kibana.alert.risk_score`) such that alerts with higher risk scores contribute more than alerts with lower risk scores. The resulting aggregated risk score is assigned to the **Alerts** category in the entity's <<host-risk-summary, risk summary>>.
38
+
. The risk scoring engine runs hourly to aggregate `Open` and `Acknowledged` alerts from the last 30 days. For each entity, the engine processes up to 10,000 alerts.
33
39
34
-
The engine then verifies the entity's <<asset-criticality, asset criticality level>>. If there is no asset criticality assigned, the entity risk score remains equal to the aggregated score from the **Alerts** category. If a criticality level is assigned, the engine updates the risk score based on the default risk weight for each criticality level:
40
+
. The engine groups alerts by `host.name` or `user.name`, and aggregates the individual alert risk scores (`kibana.alert.risk_score`) such that alerts with higher risk scores contribute more than alerts with lower risk scores. The resulting aggregated risk score is assigned to the **Alerts** category in the entity's <<host-risk-summary, risk summary>>.
35
41
42
+
. The engine then verifies the entity's <<asset-criticality, asset criticality level>>. If there is no asset criticality assigned, the entity risk score remains equal to the aggregated score from the **Alerts** category. If a criticality level is assigned, the engine updates the risk score based on the default risk weight for each criticality level. The asset criticality risk input is assigned to the **Asset Criticality** category in the entity's risk summary.
43
+
+
36
44
[width="100%",options="header"]
37
45
|==============================================
38
46
|Asset criticality level |Default risk weight
@@ -43,13 +51,11 @@ The engine then verifies the entity's <<asset-criticality, asset criticality lev
43
51
|Extreme impact |2
44
52
45
53
|==============================================
46
-
54
+
+
47
55
NOTE: Asset criticality levels and default risk weights are subject to change.
48
56
49
-
The asset criticality risk input is assigned to the **Asset Criticality** category in the entity's risk summary.
50
-
51
-
Based on the two risk inputs, the risk scoring engine generates a single numeric value, normalized to a 0-100 range, as the entity risk score. It assigns a risk level by mapping the normalized risk score to one of these levels:
52
-
57
+
. Based on the two risk inputs, the risk scoring engine generates a single entity risk score of 0-100. It assigns a risk level by mapping the risk score to one of these levels:
Copy file name to clipboardExpand all lines: docs/cloud-native-security/cspm-faq.asciidoc
+1-3Lines changed: 1 addition & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -28,9 +28,7 @@ Frequently asked questions about the Kubernetes Security Posture Management (KSP
28
28
29
29
*What versions of Kubernetes are supported?*
30
30
31
-
For self-managed/vanilla clusters, Kubernetes version 1.23 is supported.
32
-
33
-
For EKS clusters, all Kubernetes versions available at the time of cluster deployment are supported.
31
+
For self-managed/vanilla and EKS clusters, Kubernetes version 1.23 is supported.
34
32
35
33
*Do benchmark rules support multiple Kubernetes deployment types?*
36
34
Yes. There are different sets of benchmark rules for self-managed and third party-managed deployments. Refer to <<get-started-with-kspm,Get started with KSPM>> for more information about setting up each deployment type.
If the message appears, click **X** or **Try the new Editor** and follow the next steps. When you switch to the new editor, your context should remain unchanged.
62
67
. In Google Cloud Shell, execute the command you copied. Once it finishes, return to {kib} and wait for the confirmation of data received from your new integration. Then you can click **View Assets** to see your data.
63
68
69
+
NOTE: If you encounter any issues running the command, return to {kib} and navigate again to Google Cloud Shell.
70
+
64
71
NOTE: During Cloud Shell setup, the CSPM integration adds roles to Google's default service account, which enables custom role creation and attachment of the service account to a compute instance.
65
72
After setup, these roles are removed from the service account. If you attempt to delete the deployment but find the deployment manager lacks necessary permissions, consider adding the missing roles to the service account:
66
73
https://cloud.google.com/iam/docs/understanding-roles#resourcemanager.projectIamAdmin[Project IAM Admin], https://cloud.google.com/iam/docs/understanding-roles#iam.roleAdmin[Role Administrator].
0 commit comments