User risk score

The user risk score feature highlights risky usernames in your environment. It utilizes a transform with a scripted metric aggregation to calculate user risk scores based on alerts generated within the past 90 days. The transform runs hourly to update scores as new alerts are generated.

Each alert’s contribution to the user risk score is based on the alert’s risk score (signal.rule.risk_score). The risk score is calculated using a weighted sum where rules with higher time-corrected risk scores also have higher weights. Each risk score is normalized on a scale of 0 to 100.

The following table shows how risk levels are applied to a username, based on the normalized risk score:

You can enable user risk score from the following places in the Elastic Security app:

Or, in Kibana, you can enable user risk score in Console.

To enable user risk score from the Entity Analytics dashboard:

To enable user risk score from the Users page:

To enable user risk score from a user’s details page:

To enable user risk score from Console in Kibana, open a browser window and enter the following URL:

{KibanaURL}/s/{spaceID}/app/dev_tools#/console?load_from={KibanaURL}/s/{spaceID}/internal/risk_score/prebuilt_content/dev_tool/enable_user_risk_score

If you previously enabled user risk score and you’re upgrading to Elastic Stack version 8.11 or newer, you can upgrade to the latest risk scoring engine.

Before upgrading, note the following:

After this is done, you can proceed with upgrading the user risk score feature from any of the following places in the Elastic Security app:

It is recommended you analyze users with the highest risk scores first — those in the Critical and Moderate categories. User risk score data appears in the following places in the Elastic Security app:

The user.risk.calculated_level column in the Alerts table:

The Insights → Entities section on the Overview tab within the alert details flyout

The User risk tab on the Users page:

The Overview section on the user details page:

The User risk tab on the user details page:

You can also visualize user risk score data using prebuilt dashboards that are automatically imported when the feature is enabled.

To access the dashboards:

In this example, we’ll explore the Drilldown of User Risk Score dashboard.

The histogram shows historical changes in a particular user’s risk score(s). To specify a date range, use the date and time picker, or drag and select a time range within the histogram. Click View source dashboard to view the top values of user.name and risk.keyword.

The data tables beneath the histogram display associated rules, users, and MITRE ATT&CK tactics seen for risky users. By default, the tables are sorted by risk, with the highest total risk scores at the top. Use this information to triage your highest risk users.

During the installation or upgrade process, you may receive the following error messages:

In this case, we recommend that you manually delete the user risk score module, and then re-enable it. To manually delete the module:

After manually deleting the user risk score saved objects, transforms, ingest pipeline, and stored scripts, follow the steps to re-enable the user risk score module.