diff --git a/docs/advanced-entity-analytics/asset-criticality.asciidoc b/docs/advanced-entity-analytics/asset-criticality.asciidoc index e500a3da50..40f52656e7 100644 --- a/docs/advanced-entity-analytics/asset-criticality.asciidoc +++ b/docs/advanced-entity-analytics/asset-criticality.asciidoc @@ -28,6 +28,10 @@ For example, you can assign **Extreme impact** to business-critical entities, or Entities do not have a default asset criticality level. You can either assign asset criticality to your entities individually, or <> it to multiple entities by importing a text file. +When you assign, change, or unassign an individual entity's asset criticality level, that entity's risk score is immediately recalculated. + +NOTE: If you assign asset criticality using the file import feature, risk scores are **not** immediately recalculated. The newly assigned or updated asset criticality levels will impact entity risk scores during the next hourly risk scoring calculation. + You can view, assign, change, or unassign asset criticality from the following places in the {elastic-sec} app: * The <> and <>: @@ -110,7 +114,5 @@ To view the impact of asset criticality on an entity's risk score, follow these . Click **View risk contributions** to open the flyout's left panel. . In the **Risk contributions** section, verify the entity's criticality level from the time the alert was generated. -NOTE: The risk summary and **Risk contributions** sections display an entity's asset criticality from the latest risk scoring execution. If you change the asset criticality level, subsequent risk calculations will automatically factor in the newest criticality level. - [role="screenshot"] image::images/asset-criticality-impact.png[View asset criticality impact on host risk score]