- Elastic Cloud Serverless
- Elasticsearch
- Elastic Observability
- Get started
- Observability overview
- Elastic Observability Serverless billing dimensions
- Create an Observability project
- Quickstart: Monitor hosts with Elastic Agent
- Quickstart: Monitor your Kubernetes cluster with Elastic Agent
- Quickstart: Monitor hosts with OpenTelemetry
- Quickstart: Unified Kubernetes Observability with Elastic Distributions of OpenTelemetry (EDOT)
- Quickstart: Collect data with AWS Firehose
- Get started with dashboards
- Applications and services
- Application performance monitoring (APM)
- Get started with traces and APM
- Learn about data types
- Collect application data
- View and analyze data
- Act on data
- Use APM securely
- Reduce storage
- Managed intake service event API
- Troubleshooting
- Synthetic monitoring
- Get started
- Scripting browser monitors
- Configure lightweight monitors
- Manage monitors
- Work with params and secrets
- Analyze monitor data
- Monitor resources on private networks
- Use the CLI
- Configure a Synthetics project
- Multifactor Authentication for browser monitors
- Configure Synthetics settings
- Grant users access to secured resources
- Manage data retention
- Scale and architect a deployment
- Synthetics Encryption and Security
- Troubleshooting
- Application performance monitoring (APM)
- Infrastructure and hosts
- Logs
- Inventory
- Incident management
- Data set quality
- Observability AI Assistant
- Machine learning
- Reference
- Get started
- Elastic Security
- Elastic Security overview
- Security billing dimensions
- Create a Security project
- Elastic Security requirements
- Elastic Security UI
- AI for Security
- Ingest data
- Configure endpoint protection with Elastic Defend
- Manage Elastic Defend
- Endpoints
- Policies
- Trusted applications
- Event filters
- Host isolation exceptions
- Blocklist
- Optimize Elastic Defend
- Event capture and Elastic Defend
- Endpoint protection rules
- Identify antivirus software on your hosts
- Allowlist Elastic Endpoint in third-party antivirus apps
- Elastic Endpoint self-protection features
- Elastic Endpoint command reference
- Endpoint response actions
- Cloud Security
- Explore your data
- Dashboards
- Detection engine overview
- Rules
- Alerts
- Advanced Entity Analytics
- Investigation tools
- Asset management
- Manage settings
- Troubleshooting
- Manage your project
- Changelog
Entity Analytics dashboard
editEntity Analytics dashboard
editThe Entity Analytics dashboard provides a centralized view of emerging insider threats - including host risk, user risk, and anomalies from within your network. Use it to triage, investigate, and respond to these emerging threats.
Requirements
To display host and user risk scores, you must turn on the risk scoring engine.
The dashboard includes the following sections:
Entity KPIs (key performance indicators)
editDisplays the total number of critical hosts, critical users, and anomalies. Select a link to jump to the Host risk table, User risk table, or Anomalies table.
Host Risk Scores
editDisplays host risk score data for your environment, including the total number of hosts, and the five most recently recorded host risk scores, with their associated host names, risk data, and number of detection alerts. Host risk scores are calculated using a weighted sum on a scale of 0 (lowest) to 100 (highest).
Interact with the table to filter data, view more details, and take action:
- Select the Host risk level menu to filter the chart by the selected level.
- Click a host name link to open the host details flyout.
- Hover over a host name link to display inline actions: Add to timeline, which adds the selected value to Timeline, and Copy to Clipboard, which copies the host name value for you to paste later.
- Click View all in the upper-right to display all host risk information on the Hosts page.
-
Click the number link in the Alerts column to view the alerts on the Alerts page. Hover over the number and select Investigate in timeline (
) to launch Timeline with a query that includes the associated host name value.
For more information about host risk scores, refer to Entity risk scoring.
User Risk Scores
editDisplays user risk score data for your environment, including the total number of users, and the five most recently recorded user risk scores, with their associated user names, risk data, and number of detection alerts. Like host risk scores, user risk scores are calculated using a weighted sum on a scale of 0 (lowest) to 100 (highest).
Interact with the table to filter data, view more details, and take action:
- Select the User risk level menu to filter the chart by the selected level.
- Click a user name link to open the user details flyout.
- Hover over a user name link to display inline actions: Add to timeline, which adds the selected value to Timeline, and Copy to Clipboard, which copies the user name value for you to paste later.
- Click View all in the upper-right to display all user risk information on the Users page.
-
Click the number link in the Alerts column to view the alerts on the Alerts page. Hover over the number and select Investigate in timeline () to launch Timeline with a query that includes the associated user name value.
For more information about user risk scores, refer to Entity risk scoring.
Anomalies
editAnomaly detection jobs identify suspicious or irregular behavior patterns. The Anomalies table displays the total number of anomalies identified by these prebuilt machine learning jobs (named in the Anomaly name column).
Requirements
To display anomaly results, you must install and run one or more prebuilt anomaly detection jobs. You cannot add custom anomaly detection jobs to the Entity Analytics dashboard.
Interact with the table to view more details:
- Click View all host anomalies to go to the Anomalies table on the Hosts page.
- Click View all user anomalies to go to the Anomalies table on the Users page.
- Click View all to display and manage all machine learning jobs on the Anomaly Detection Jobs page.
To learn more about machine learning, refer to What is Elastic machine learning?