From fb0d9830998d1613011a60a30c705bd4bc0a7a2a Mon Sep 17 00:00:00 2001 From: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com> Date: Tue, 7 Nov 2023 13:27:39 +0000 Subject: [PATCH] Entity Analytics: Requirements and limitations (#4162) * Entity Analytics: Requirements and limitations * Fixes capitalization * Uses attribute * Update docs/getting-started/ea-req.asciidoc Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com> * Update docs/getting-started/ea-req.asciidoc Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com> * Update docs/getting-started/ea-req.asciidoc Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com> * Update docs/getting-started/ea-req.asciidoc Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com> * Applies review comments * Adds reference to Entity Risk Scoring * Updates licensing info * Applies review feedback * Update docs/getting-started/ers-req.asciidoc --------- Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com> (cherry picked from commit aad7b2705c51d2b935a45aa81a59a112f94ce744) --- docs/getting-started/ers-req.asciidoc | 44 +++++++++++++++++++ docs/getting-started/index.asciidoc | 1 + .../sec-app-requirements.asciidoc | 1 + 3 files changed, 46 insertions(+) create mode 100644 docs/getting-started/ers-req.asciidoc diff --git a/docs/getting-started/ers-req.asciidoc b/docs/getting-started/ers-req.asciidoc new file mode 100644 index 0000000000..5a4092a6d0 --- /dev/null +++ b/docs/getting-started/ers-req.asciidoc @@ -0,0 +1,44 @@ +[[ers-requirements]] += Entity Risk Scoring prerequisites + +To use Entity Risk Scoring, your role must have certain cluster, index, and {kib} privileges. This feature requires a https://www.elastic.co/pricing[Platinum subscription] or higher. + +This page covers the requirements and guidelines for using the Entity Risk Scoring feature, as well as its known limitations. + +[discrete] +== Privileges + +To turn on the risk scoring engine, you need the following privileges: + +[discrete] +[width="100%",options="header"] +|============================================== + +| Cluster | Index | {kib} +a| +* `manage_index_templates` +* `manage_transform` + +| `all` privilege for `risk-score.risk-score-*` + +a| +* **All** for the **Saved Objects Management** feature under **Management** +* **Read** for the **Security** feature + +|============================================== + +[discrete] +== {es} resource guidelines + +Follow these guidelines to ensure clusters have adequate memory to handle data volume: + +* With 2GB of Java Virtual Machine (JVM) heap memory, the risk scoring engine can safely process around 44 million documents, or 30 days of risk data with an ingest rate of 1000 documents per minute. + +* With 1GB of JVM heap, the risk scoring engine can safely process around 20 million documents, or 30 days of risk data with an ingest rate of around 450 documents per minute. + +[discrete] +== Known limitations + +* You can only enable the risk scoring engine in a single {kib} space within a cluster. + +* The risk scoring engine uses an internal user role to score all hosts and users, and doesn't respect privileges applied to custom users or roles. After you turn on the risk scoring engine for a {kib} space, all alerts in the space will contribute to host and user risk scores. diff --git a/docs/getting-started/index.asciidoc b/docs/getting-started/index.asciidoc index 8c2ad22bfb..07bd816c11 100644 --- a/docs/getting-started/index.asciidoc +++ b/docs/getting-started/index.asciidoc @@ -9,6 +9,7 @@ TIP: View the https://www.elastic.co/training/elastic-security-quick-start[{elas include::sec-app-requirements.asciidoc[leveloffset=+1] include::detections-req.asciidoc[leveloffset=+2] include::cases-req.asciidoc[leveloffset=+2] +include::ers-req.asciidoc[leveloffset=+2] include::ml-req.asciidoc[leveloffset=+2] include::defend-feature-privs.asciidoc[leveloffset=+2] include::net-map-req.asciidoc[leveloffset=+2] diff --git a/docs/getting-started/sec-app-requirements.asciidoc b/docs/getting-started/sec-app-requirements.asciidoc index 44ad0300ea..4d5f9a4e63 100644 --- a/docs/getting-started/sec-app-requirements.asciidoc +++ b/docs/getting-started/sec-app-requirements.asciidoc @@ -44,6 +44,7 @@ There are some additional requirements for specific features: * <> * <> +* <> * <> * <> * <>