Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Entity Analytics: Requirements and limitations #4162

Merged
merged 14 commits into from
Nov 7, 2023
Merged

Entity Analytics: Requirements and limitations #4162

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
010996c
Entity Analytics: Requirements and limitations
natasha-moore-elastic Nov 1, 2023
a3a12ea
Fixes capitalization
natasha-moore-elastic Nov 1, 2023
89a424c
Uses attribute
natasha-moore-elastic Nov 1, 2023
d12e9e0
Update docs/getting-started/ea-req.asciidoc
natasha-moore-elastic Nov 2, 2023
a3ec7b1
Update docs/getting-started/ea-req.asciidoc
natasha-moore-elastic Nov 2, 2023
69ccf0f
Update docs/getting-started/ea-req.asciidoc
natasha-moore-elastic Nov 2, 2023
6ae21aa
Update docs/getting-started/ea-req.asciidoc
natasha-moore-elastic Nov 2, 2023
981b0c6
Applies review comments
natasha-moore-elastic Nov 2, 2023
00c76d9
Adds reference to Entity Risk Scoring
natasha-moore-elastic Nov 3, 2023
de68953
Updates licensing info
natasha-moore-elastic Nov 6, 2023
6662e52
Applies review feedback
natasha-moore-elastic Nov 7, 2023
0b9f8fa
Merge branch 'main' into issue-4124-EA-reqs
natasha-moore-elastic Nov 7, 2023
f2e8763
Merge branch 'main' into issue-4124-EA-reqs
natasha-moore-elastic Nov 7, 2023
62a20f4
Update docs/getting-started/ers-req.asciidoc
natasha-moore-elastic Nov 7, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 37 additions & 0 deletions docs/getting-started/ea-req.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
[[ea-requirements]]
= Entity Analytics prerequisites

Copy link
Contributor

@nastasha-solomon nastasha-solomon Nov 1, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@natasha-moore-elastic following the page title with a section header is a bit jarring. To give users some quick context, it might be useful to write a sentence or two that briefly summarizes this page.

@SourinPaul are we now calling the risk scoring feature "Entity Analytics" in the docs? Also, should this page be included under the Useful links section within the Entity Risk Score page? Linking to multiple doc pages in the UI is a little excessive imo, but I definitely think feature requirements are necessary to highlight.

Screenshot 2023-11-01 at 2 46 47 PM

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@SourinPaul are we now calling the risk scoring feature "Entity Analytics" in the docs? Also, should this page be included under the Useful links section within the Entity Risk Score page? Linking to multiple doc pages in the UI is a little excessive imo, but I definitely think feature requirements are necessary to highlight.

@nastasha-solomon the current UI reference to the feature is incorrect. Here is the bug logged to correct the UI reference #7920. In its correct form, the UI reference will take the user to the (new) Entity Risk Scoring feature documentation page.

I agree that linking to multiple doc pages (Feature overview, Prerequisites for the feature) in the UI may be excessive, given we expect to improve or evolve the feature quickly.

How about ensuring the Entity Risk Scoring Prerequisites section is highlighted on the page the user first lands ( section above)?

Copy link
Contributor

@nastasha-solomon nastasha-solomon Nov 1, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for sharing that issue, @SourinPaul. Good to know that the links are being updated for 8.11! :)

As for linking this page, I do think it should be placed at the top of the list under the Useful links section. I'd use the page title as well, so the linked text is consistent with our docs.

Lastly, it might be a good idea to reference this page wherever these privileges are needed to view risk score data within the Security app. For example, if these privileges are required to turn on and or view risk score in the Entity Analytics dashboard, I would mention it there. I'm not sure what that'd look like, or if there's even time to add it into 8.11, so just something to consider for a future release.

[discrete]
== Privileges

To enable the risk scoring engine, you need the following privileges:
natasha-moore-elastic marked this conversation as resolved.
Show resolved Hide resolved

Cluster privileges:
natasha-moore-elastic marked this conversation as resolved.
Show resolved Hide resolved

* `manage_index_templates`
* `manage_transform`

Index privileges:

`all` privilege for `risk-score.risk-score-*`

{kib} privileges:

* **All** for the **Saved Objects Management** feature under **Management**
* **Read** for the **Security** feature

[discrete]
== {es} resource guidelines

Follow these guidelines to ensure clusters have adequate memory to handle data volume:

* With 2GB of Java Virtual Machine (JVM) heap memory, the risk scoring task can safely process around 44 million documents (30 days of risk data with an ingest rate of 1000 documents per minute).
natasha-moore-elastic marked this conversation as resolved.
Show resolved Hide resolved

* With 1GB of JVM heap, the risk scoring task can safely process around 20 million documents (30 days of risk data with an ingest rate of around 450 documents per minute).
natasha-moore-elastic marked this conversation as resolved.
Show resolved Hide resolved

[discrete]
== Known limitations

* You can only enable the risk scoring engine in a single {kib} space within a cluster.

* The risk scoring engine uses the internal {kib} user to score all hosts and users. This means the scoring task does not respect custom user or role permissions. All alerts from the configured {kib} space will contribute to the entity's risk.
natasha-moore-elastic marked this conversation as resolved.
Show resolved Hide resolved
1 change: 1 addition & 0 deletions docs/getting-started/index.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ TIP: View the https://www.elastic.co/training/elastic-security-quick-start[{elas
include::sec-app-requirements.asciidoc[leveloffset=+1]
include::detections-req.asciidoc[leveloffset=+2]
include::cases-req.asciidoc[leveloffset=+2]
include::ea-req.asciidoc[leveloffset=+2]
include::ml-req.asciidoc[leveloffset=+2]
include::defend-feature-privs.asciidoc[leveloffset=+2]
include::net-map-req.asciidoc[leveloffset=+2]
Expand Down
1 change: 1 addition & 0 deletions docs/getting-started/sec-app-requirements.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,7 @@ There are some additional requirements for specific features:

* <<detections-permissions-section>>
* <<case-permissions>>
* <<ea-requirements>>
* <<ml-requirements>>
* <<elastic-endpoint-deploy-reqs, {elastic-endpoint} requirements>>
* <<conf-map-ui>>
Expand Down