Skip to content

Commit

Permalink
[8.15] Documents risk score recalculation when asset criticality is c…
Browse files Browse the repository at this point in the history
…hanged (#5193)

* Documents risk score recalculation when asset criticality is changed

* Corrects information about bulk assignment

* Serverless PR feedback
  • Loading branch information
natasha-moore-elastic authored Jul 1, 2024
1 parent 2fb51b1 commit 65642ba
Showing 1 changed file with 4 additions and 2 deletions.
6 changes: 4 additions & 2 deletions docs/advanced-entity-analytics/asset-criticality.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,10 @@ For example, you can assign **Extreme impact** to business-critical entities, or

Entities do not have a default asset criticality level. You can either assign asset criticality to your entities individually, or <<bulk-assign-asset-criticality, bulk assign>> it to multiple entities by importing a text file.

When you assign, change, or unassign an individual entity's asset criticality level, that entity's risk score is immediately recalculated.

NOTE: If you assign asset criticality using the file import feature, risk scores are **not** immediately recalculated. The newly assigned or updated asset criticality levels will impact entity risk scores during the next hourly risk scoring calculation.

You can view, assign, change, or unassign asset criticality from the following places in the {elastic-sec} app:

* The <<host-details-page, host details page>> and <<user-details-page, user details page>>:
Expand Down Expand Up @@ -110,7 +114,5 @@ To view the impact of asset criticality on an entity's risk score, follow these
. Click **View risk contributions** to open the flyout's left panel.
. In the **Risk contributions** section, verify the entity's criticality level from the time the alert was generated.

NOTE: The risk summary and **Risk contributions** sections display an entity's asset criticality from the latest risk scoring execution. If you change the asset criticality level, subsequent risk calculations will automatically factor in the newest criticality level.

[role="screenshot"]
image::images/asset-criticality-impact.png[View asset criticality impact on host risk score]

0 comments on commit 65642ba

Please sign in to comment.