Entity analytics requirements

This page covers the requirements and guidelines for using the entity risk scoring, asset criticality, and entity store features, as well as their known limitations.

To use these features in Elastic Stack, your role must have certain cluster, index, and Kibana privileges. In Serverless, you need the appropriate user roles or a custom role with the right privileges.

In Elastic Stack, these features require a Platinum subscription or higher. In Serverless, they require the Security Analytics Complete project feature tier.

Note

For the requirements to run anomaly detection jobs and behavioral detection rules, refer to Machine learning job and rule requirements.

Entity risk scoring

To install or run risk scoring, you need the following:

In Elastic Stack, you need the appropriate privileges.
In Serverless, you need either the appropriate predefined Security user role or a custom role with the right privileges.

Privileges

Action	Cluster Privileges	Index Privileges	Kibana Privileges
Install risk scoring	`manage_index_templates` `manage_transform` `manage_ingest_pipelines`	`All` for `risk-score.risk-score-*`	Read for the Security feature
Run risk scoring	`manage_transform`	N/A	Read for the Security feature
The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.4 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. Preview the risk score results	N/A	`Read` for `.alerts-security.alerts-*`	Read for the Security feature
The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.4 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. View alert risk contributions in entity details	N/A	N/A	Read for the Security > Alerts feature
The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.4 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. View the Engine Status tab	`manage_index_templates` `manage_transform` `manage_ingest_pipelines` `manage_enrich`	`All` for `risk-score.risk-score-*`	Read for the Security feature

Predefined roles

Action	Predefined role
Install risk scoring	- Platform engineer - Admin
Run risk scoring	- Platform engineer - Detections admin - Admin

Elasticsearch resource guidelines

Follow these guidelines to ensure clusters have adequate memory to handle data volume:

With 2GB of Java Virtual Machine (JVM) heap memory, risk scoring can safely process around 44 million documents, or 30 days of risk data with an ingest rate of 1000 documents per minute.
With 1GB of JVM heap, risk scoring can safely process around 20 million documents, or 30 days of risk data with an ingest rate of around 450 documents per minute.

Known limitations

Risk scoring uses an internal user role to score all hosts, users, and services, and doesn’t respect privileges applied to custom users or roles. After you turn on risk scoring for a Kibana space, all alerts in the space will contribute to host, user, and service risk scores.
You cannot customize alert data views or risk weights associated with alerts and asset criticality levels.

Asset criticality

To use asset criticality, you need the following:

In Elastic Stack, you need the appropriate privileges.
In Serverless, you need either the appropriate predefined Security user role or a custom role with the right privileges.

Privileges

Serverless Stack 9.4+

Action	Index privilege
View asset criticality	`read` for `entities-latest-<space-id>` and `.entities.v2.latest.security_<space-id>-*`
View, assign, unassign, or change asset criticality	`read` and `write` for `entities-latest-<space-id>` and `read`, `write`, and `view_index_metadata` for `.entities.v2.latest.security_<space-id>-*`

Stack 9.0-9.3

Action	Index privilege
View asset criticality	`read` for `.asset-criticality.asset-criticality-<space-id>`
View, assign, or change asset criticality	`read` and `write` for `.asset-criticality.asset-criticality-<space-id>`
Unassign asset criticality	`delete` for `.asset-criticality.asset-criticality-<space-id>`

Predefined roles

Action	Predefined role
View asset criticality	- Viewer - Tier 1 analyst
View, assign, change, or unassign asset criticality	- Editor - Tier 2 analyst - Tier 3 analyst - Threat intelligence analyst - Rule author - SOC manager - Endpoint operations analyst - Platform engineer - Detections admin - Endpoint policy manager

Entity store

To turn on the entity store, you need the following:

In Elastic Stack, you need the appropriate privileges.
In Serverless, you need either the Admin role or a custom role with the right privileges.

Privileges

Serverless Stack 9.4+

Cluster

manage_index_templates

Index

read and view_index_metadata for .asset-criticality.asset-criticality-*
read and manage for risk-score.risk-score-*
read and write for .entities.v2.latest.security_*
Additionally, manage for .entities.v2.latest.security_* is required to add or remove entities from a resolution group in the Resolution section of the entity details flyout
read and view_index_metadata for all Elastic Security indices