Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[8.15] Documents risk score recalculation when asset criticality is changed #5193

Merged
merged 5 commits into from
Jul 1, 2024
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions docs/advanced-entity-analytics/asset-criticality.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,10 @@ For example, you can assign **Extreme impact** to business-critical entities, or

Entities do not have a default asset criticality level. You can either assign asset criticality to your entities individually, or <<bulk-assign-asset-criticality, bulk assign>> it to multiple entities by importing a text file.

When you assign, change, or unassign an individual entity's asset criticality level, that entity's risk score is immediately recalculated.

NOTE: If you assign asset criticality using the file import feature, risk scores are **not** immediately recalculated. The newly assigned or updated asset criticality levels will impact entity risk scores during the next hourly risk scoring calculation.

You can view, assign, change, or unassign asset criticality from the following places in the {elastic-sec} app:

* The <<host-details-page, host details page>> and <<user-details-page, user details page>>:
Expand Down Expand Up @@ -110,7 +114,5 @@ To view the impact of asset criticality on an entity's risk score, follow these
. Click **View risk contributions** to open the flyout's left panel.
. In the **Risk contributions** section, verify the entity's criticality level from the time the alert was generated.

NOTE: The risk summary and **Risk contributions** sections display an entity's asset criticality from the latest risk scoring execution. If you change the asset criticality level, subsequent risk calculations will automatically factor in the newest criticality level.

[role="screenshot"]
image::images/asset-criticality-impact.png[View asset criticality impact on host risk score]