Skip to content

Asset criticality advanced setting removed #5991

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Oct 30, 2024
Merged

Asset criticality advanced setting removed #5991

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/advanced-entity-analytics/api/asset-criticality-api-overview.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,4 +8,4 @@
For the most up-to-date API details, refer to {api-kibana}/group/endpoint-security-entity-analytics-api[Entity Analytics APIs].
--

You can manage <<asset-criticality, asset criticality>> records through the API. To use this API, you must first turn on the `securitySolution:enableAssetCriticality` <<enable-asset-criticality, advanced setting>>.
You can manage <<asset-criticality, asset criticality>> records through the API.
7 changes: 1 addition & 6 deletions docs/advanced-entity-analytics/asset-criticality.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,12 +4,7 @@
.Requirements
[sidebar]
--
To view and assign asset criticality, you must:

* Have the appropriate user role.
* Turn on the `securitySolution:enableAssetCriticality` <<enable-asset-criticality, advanced setting>>.

For more information, refer to <<ers-requirements, Entity risk scoring prerequisites>>.
To view and assign asset criticality, you must have the appropriate user role. For more information, refer to <<ers-requirements, Entity risk scoring prerequisites>>.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just a bit confused here because I thought the PR I just reviewed said Asset Criticality was being renamed to Entity Store?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Asset Criticality page is now called Entity Store, but asset criticality as a feature still exists, it's just now managed through the Entity Store page.

--

The asset criticality feature allows you to classify your organization's entities based on various operational factors that are important to your organization. Through this classification, you can improve your threat detection capabilities by focusing your alert triage, threat-hunting, and investigation activities on high-impact entities.
Expand Down
6 changes: 1 addition & 5 deletions docs/advanced-entity-analytics/entity-risk-scoring.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,11 +30,7 @@ Entity risk scores are determined by the following risk inputs:

The resulting entity risk scores are stored in the `risk-score.risk-score-<space-id>` data stream alias.

[NOTE]
======
* Entities without any alerts, or with only `Closed` alerts, are not assigned a risk score.
* To use asset criticality, you must enable the `securitySolution:enableAssetCriticality` <<enable-asset-criticality, advanced setting>>.
======
NOTE: Entities without any alerts, or with only `Closed` alerts, are not assigned a risk score.

[discrete]
[[how-is-risk-score-calculated]]
Expand Down
2 changes: 0 additions & 2 deletions docs/advanced-entity-analytics/ers-req.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,8 +45,6 @@ The risk scoring engine uses an internal user role to score all hosts and users,
[discrete]
== Asset criticality

To use the asset criticality feature, turn on the `securitySolution:enableAssetCriticality` <<enable-asset-criticality, advanced setting>>.

[discrete]
=== Privileges

Expand Down
5 changes: 0 additions & 5 deletions docs/getting-started/advanced-setting.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,11 +102,6 @@ Security *Overview* page.
* `securitySolution:newsFeedUrl`: The URL from which the security news feed content is
retrieved.

[discrete]
[[enable-asset-criticality]]
== Enable asset criticality workflows
The `securitySolution:enableAssetCriticality` setting determines whether asset criticality is included as a risk input to entity risk scoring. This setting is turned off by default. Turn it on to enable asset criticality workflows and to use asset criticality as part of entity risk scoring.

[discrete]
[[exclude-cold-frozen-tiers]]
== Exclude cold and frozen tier data from analyzer queries
Expand Down
8 changes: 1 addition & 7 deletions docs/getting-started/users-page.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ A user's details page displays all relevant information for the selected user. T

The user details page includes the following sections:

* **Asset Criticality**: If the `securitySolution:enableAssetCriticality` <<enable-asset-criticality, advanced setting>> is on, this section displays the user's current <<asset-criticality, asset criticality level>>.
* **Asset Criticality**: This section displays the user's current <<asset-criticality, asset criticality level>>.

* *Summary*: Details such as the user ID, when the user was first and last seen, the associated IP address(es), and operating system. If the user risk score feature is enabled, this section also displays user risk score data.

Expand Down Expand Up @@ -99,12 +99,6 @@ image::images/users/user-risk-inputs.png[User risk inputs]
[[user-asset-criticality-section]]
=== Asset Criticality

.Requirements
[sidebar]
--
The **Asset Criticality** section is only available if the `securitySolution:enableAssetCriticality` <<enable-asset-criticality, advanced setting>> is on.
--

The **Asset Criticality** section displays the selected user's <<asset-criticality, asset criticality level>>. Asset criticality contributes to the overall <<entity-risk-scoring, user risk score>>. The criticality level defines how impactful the user is when calculating the risk score.

[role="screenshot"]
Expand Down
8 changes: 1 addition & 7 deletions docs/management/hosts/hosts-overview.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ A host's details page displays all relevant information for the selected host. T

The host details page includes the following sections:

* **Asset Criticality**: If the `securitySolution:enableAssetCriticality` <<enable-asset-criticality, advanced setting>> is on, this section displays the host's current <<asset-criticality, asset criticality level>>.
* **Asset Criticality**: This section displays the host's current <<asset-criticality, asset criticality level>>.
* *Summary*: Details such as the host ID, when the host was first and last seen, the associated IP addresses, and associated operating system. If the host risk score feature is enabled, this section also displays host risk score data.
* *Alert metrics*: The total number of alerts by severity, rule, and status (`Open`, `Acknowledged`, or `Closed`).
* *Data tables*: The same data tables as on the main Hosts page, except with values for the selected host instead of all hosts.
Expand Down Expand Up @@ -102,12 +102,6 @@ image::images/host-risk-inputs.png[Host risk inputs]
[[host-asset-criticality-section]]
=== Asset Criticality

.Requirements
[sidebar]
--
The **Asset Criticality** section is only available if the `securitySolution:enableAssetCriticality` <<enable-asset-criticality, advanced setting>> is on.
--

The **Asset Criticality** section displays the selected host's <<asset-criticality, asset criticality level>>. Asset criticality contributes to the overall <<entity-risk-scoring, host risk score>>. The criticality level defines how impactful the host is when calculating the risk score.

[role="screenshot"]
Expand Down
6 changes: 1 addition & 5 deletions docs/serverless/advanced-entity-analytics/asset-criticality.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,11 +9,7 @@ status: in review
<DocBadge template="technical preview" />

<DocCallOut title="Requirements">
To view and assign asset criticality, you must:
* Have the appropriate user role.
* Turn on the `securitySolution:enableAssetCriticality` <DocLink slug="/serverless/security/advanced-settings" section="enable-asset-criticality-workflows" >advanced setting</DocLink>.

For more information, refer to <DocLink slug="/serverless/security/ers-requirements">Entity risk scoring prerequisites</DocLink>.
To view and assign asset criticality, you must have the appropriate user role. For more information, refer to <DocLink slug="/serverless/security/ers-requirements">Entity risk scoring prerequisites</DocLink>.
</DocCallOut>

The asset criticality feature allows you to classify your organization's entities based on various operational factors that are important to your organization. Through this classification, you can improve your threat detection capabilities by focusing your alert triage, threat-hunting, and investigation activities on high-impact entities.
Expand Down
3 changes: 1 addition & 2 deletions docs/serverless/advanced-entity-analytics/entity-risk-scoring.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,8 +42,7 @@ The resulting entity risk scores are stored in the `risk-score.risk-score-<space

<DocCallOut title="Note">

* Entities without any alerts, or with only `Closed` alerts, are not assigned a risk score.
* To use asset criticality, you must enable the `securitySolution:enableAssetCriticality` <DocLink slug="/serverless/security/advanced-settings" section="enable-asset-criticality-workflows" >advanced setting</DocLink>.
Entities without any alerts, or with only `Closed` alerts, are not assigned a risk score.

</DocCallOut>

Expand Down
2 changes: 0 additions & 2 deletions docs/serverless/advanced-entity-analytics/ers-req.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,8 +41,6 @@ To turn on the risk scoring engine, you need either the appropriate <DocLink slu

## Asset criticality
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm confused because in the preview this says Entity Risk Scoring but here it says Asset Criticality. Not a problem I guess since the preview looks good? Maybe I'm confused

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry, should have linked to the exact section – https://security-docs_bk_5991.docs-preview.app.elstc.co/guide/en/security/master/ers-requirements.html#_asset_criticality. I'll edit the link in the description.


To use the asset criticality feature, turn on the `securitySolution:enableAssetCriticality` <DocLink slug="/serverless/security/advanced-settings" section="enable-asset-criticality-workflows" >advanced setting</DocLink>.

### User roles

To use asset criticality, you need either the appropriate <DocLink slug="/serverless/general/assign-user-roles">predefined Security user role</DocLink> or a <DocLink slug="/serverless/custom-roles">custom role</DocLink> with the right privileges:
Expand Down
6 changes: 1 addition & 5 deletions docs/serverless/explore/hosts-overview.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ A host's details page displays all relevant information for the selected host. T

The host details page includes the following sections:

* **Asset Criticality**: If the `securitySolution:enableAssetCriticality` <DocLink slug="/serverless/security/advanced-settings" section="enable-asset-criticality-workflows" >advanced setting</DocLink> is on, this section displays the host's current <DocLink slug="/serverless/security/asset-criticality">asset criticality level</DocLink>.
* **Asset Criticality**: This section displays the host's current <DocLink slug="/serverless/security/asset-criticality">asset criticality level</DocLink>.
* **Summary**: Details such as the host ID, when the host was first and last seen, the associated IP addresses, and associated operating system. If the entity risk score feature is enabled, this section also displays host risk score data.
* **Alert metrics**: The total number of alerts by severity, rule, and status (`Open`, `Acknowledged`, or `Closed`).
* **Data tables**: The same data tables as on the main Hosts page, except with values for the selected host instead of all hosts.
Expand Down Expand Up @@ -99,10 +99,6 @@ If more than 10 alerts contributed to the risk scoring calculation, the remainin

### Asset Criticality

<DocCallOut title="Requirements">
The **Asset Criticality** section is only available if the `securitySolution:enableAssetCriticality` <DocLink slug="/serverless/security/advanced-settings" section="enable-asset-criticality-workflows" >advanced setting</DocLink> is on.
</DocCallOut>

The **Asset Criticality** section displays the selected host's <DocLink slug="/serverless/security/asset-criticality">asset criticality level</DocLink>. Asset criticality contributes to the overall <DocLink slug="/serverless/security/entity-risk-scoring" >host risk score</DocLink>. The criticality level defines how impactful the host is when calculating the risk score.

![Asset criticality](../images/hosts-overview/-host-asset-criticality.png)
Expand Down
6 changes: 1 addition & 5 deletions docs/serverless/explore/users-page.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ A user's details page displays all relevant information for the selected user. T

The user details page includes the following sections:

* **Asset Criticality**: If the `securitySolution:enableAssetCriticality` <DocLink slug="/serverless/security/advanced-settings" section="enable-asset-criticality-workflows" >advanced setting</DocLink> is on, this section displays the user's current <DocLink slug="/serverless/security/asset-criticality">asset criticality level</DocLink>.
* **Asset Criticality**: This section displays the user's current <DocLink slug="/serverless/security/asset-criticality">asset criticality level</DocLink>.

* **Summary**: Details such as the user ID, when the user was first and last seen, the associated IP address(es), and operating system. If the entity risk score feature is enabled, this section also displays user risk score data.

Expand Down Expand Up @@ -93,10 +93,6 @@ If more than 10 alerts contributed to the risk scoring calculation, the remainin

### Asset Criticality

<DocCallOut title="Requirement">
The **Asset Criticality** section is only available if the `securitySolution:enableAssetCriticality` <DocLink slug="/serverless/security/advanced-settings" section="enable-asset-criticality-workflows" >advanced setting</DocLink> is on.
</DocCallOut>

The **Asset Criticality** section displays the selected user's <DocLink slug="/serverless/security/asset-criticality">asset criticality level</DocLink>. Asset criticality contributes to the overall <DocLink slug="/serverless/security/entity-risk-scoring" >user risk score</DocLink>. The criticality level defines how impactful the user is when calculating the risk score.

![Asset criticality](../images/users-page/-user-asset-criticality.png)
Expand Down
4 changes: 0 additions & 4 deletions docs/serverless/settings/advanced-settings.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,10 +126,6 @@ You can change these settings, which affect the news feed displayed on the
* `securitySolution:newsFeedUrl`: The URL from which the security news feed content is
retrieved.

## Enable asset criticality workflows

The `securitySolution:enableAssetCriticality` setting determines whether asset criticality is included as a risk input to entity risk scoring. This setting is turned off by default. Turn it on to enable asset criticality workflows and to use asset criticality as part of entity risk scoring.

## Exclude cold and frozen tier data from analyzer queries

Including data from cold and frozen [data tiers](((ref))/data-tiers.html) in <DocLink slug="/serverless/security/visual-event-analyzer">visual event analyzer</DocLink> queries may result in performance degradation. The `securitySolution:excludeColdAndFrozenTiersInAnalyzer` setting allows you to exclude this data from analyzer queries. This setting is turned off by default.
Expand Down
Loading