Entity Analytics: Requirements and limitations

[natasha-moore-elastic]

Resolves #4124.

Adds a new page within Elastic Security requirements that outlines user requirements and known limitations of the new risk scoring engine.

Preview: Entity Analytics prerequisites

[github-actions]

Documentation previews:

• ✨ HTML diff
• 📙 Elastic Security Guide

[nastasha-solomon]

Overall, it looks great! I left a few suggestions and questions below. Hopefully they're helpful. 😄

[nastasha-solomon]

@natasha-moore-elastic following the page title with a section header is a bit jarring. To give users some quick context, it might be useful to write a sentence or two that briefly summarizes this page.

@SourinPaul are we now calling the risk scoring feature "Entity Analytics" in the docs? Also, should this page be included under the Useful links section within the Entity Risk Score page? Linking to multiple doc pages in the UI is a little excessive imo, but I definitely think feature requirements are necessary to highlight.

[SourinPaul]

@SourinPaul are we now calling the risk scoring feature "Entity Analytics" in the docs? Also, should this page be included under the Useful links section within the Entity Risk Score page? Linking to multiple doc pages in the UI is a little excessive imo, but I definitely think feature requirements are necessary to highlight.

@nastasha-solomon the current UI reference to the feature is incorrect. Here is the bug logged to correct the UI reference #7920. In its correct form, the UI reference will take the user to the (new) Entity Risk Scoring feature documentation page.

I agree that linking to multiple doc pages (Feature overview, Prerequisites for the feature) in the UI may be excessive, given we expect to improve or evolve the feature quickly.

How about ensuring the Entity Risk Scoring Prerequisites section is highlighted on the page the user first lands ( section above)?

[nastasha-solomon]

Thanks for sharing that issue, @SourinPaul. Good to know that the links are being updated for 8.11! :)

As for linking this page, I do think it should be placed at the top of the list under the Useful links section. I'd use the page title as well, so the linked text is consistent with our docs.

Lastly, it might be a good idea to reference this page wherever these privileges are needed to view risk score data within the Security app. For example, if these privileges are required to turn on and or view risk score in the Entity Analytics dashboard, I would mention it there. I'm not sure what that'd look like, or if there's even time to add it into 8.11, so just something to consider for a future release.

[natasha-moore-elastic]

Thanks for the fast reviews @nastasha-solomon & @SourinPaul! I've applied the suggestions and comments.

[natasha-moore-elastic]

The build has failed because of the reference to the <<entity-risk-scoring, Entity Risk Scoring>> section, which isn't in main yet. Once PR #4167 is merged, the build should pass.

[joepeeples]

A couple of small comments, and one general question: what's the preferred capitalization for this feature? Sometimes it appears title case, other times lowercase. I personally prefer lowercase for most features, but it depends on how Product is positioning and branding this.

[natasha-moore-elastic]

A couple of small comments, and one general question: what's the preferred capitalization for this feature? Sometimes it appears title case, other times lowercase. I personally prefer lowercase for most features, but it depends on how Product is positioning and branding this.

Good question! @SourinPaul, is there a preference to capitalize the feature name from the Product side? If not, let's lowercase it, per our capitalization guidelines.

[jmikell821]

Nothing to add; previous feedback looks good.