Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions docs/advanced-entity-analytics/asset-criticality.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,10 @@ For example, you can assign **Extreme impact** to business-critical entities, or

Entities do not have a default asset criticality level. You can either assign asset criticality to your entities individually, or <<bulk-assign-asset-criticality, bulk assign>> it to multiple entities by importing a text file.

When you assign, change, or unassign an individual entity's asset criticality level, that entity's risk score is immediately recalculated.

NOTE: If you assign asset criticality using the file import feature, risk scores are **not** immediately recalculated. The newly assigned or updated asset criticality levels will impact entity risk scores during the next hourly risk scoring calculation.

You can view, assign, change, or unassign asset criticality from the following places in the {elastic-sec} app:

* The <<host-details-page, host details page>> and <<user-details-page, user details page>>:
Expand Down Expand Up @@ -110,7 +114,5 @@ To view the impact of asset criticality on an entity's risk score, follow these
. Click **View risk contributions** to open the flyout's left panel.
. In the **Risk contributions** section, verify the entity's criticality level from the time the alert was generated.

NOTE: The risk summary and **Risk contributions** sections display an entity's asset criticality from the latest risk scoring execution. If you change the asset criticality level, subsequent risk calculations will automatically factor in the newest criticality level.

[role="screenshot"]
image::images/asset-criticality-impact.png[View asset criticality impact on host risk score]