Entity Analytics dashboardedit
The Entity Analytics dashboard provides a centralized view of emerging insider threats - including host risk, user risk, and notable anomalies from within your network. Use it to triage, investigate, and respond to these emerging threats.
The dashboard includes the following sections:
Entity KPIs (key performance indicators)edit
Displays the total number of critical hosts, critical users, and anomalies. Select a link to go to the Host risk table, User risk table, or Anomaly Detection Jobs page.
Host Risk Scoresedit
Displays host risk score data for your environment, including the total number of hosts, and the five most recently recorded host risk scores, with their associated host names and risk classifications. Host risk scores are calculated using a weighted sum on a scale of 0 (lowest) to 100 (highest).
Interact with the table to filter data or view more details:
- Select the Host risk classification menu to filter the chart by the selected classification.
- Click a host name link to go to the Host details page.
- Click View all in the upper-right to display all host risk information on the Hosts page.
For more information about host risk scores, click the Learn more link in the table, or refer to Host risk score.
User Risk Scoresedit
Displays user risk score data for your environment, including the total number of users, and the five most recently recorded user risk scores, with their associated user names and risk classifications. Like host risk scores, user risk scores are calculated using a weighted sum on a scale of 0 (lowest) to 100 (highest).
Interact with the table to filter data or view more details:
- Select the User risk classification menu to filter the chart by the selected classification.
- Click a user name link to go to the User details page.
- Click View all in the upper-right to display all user risk information on the Users page.
The host risk and user risk score tables are not affected by the date and time range.
Notable Anomaliesedit
Anomalies identify suspicious or irregular behavior patterns. The Notable Anomalies table displays the total number of host and user anomalies identified by six predefined machine learning jobs (named in the Anomaly name column). These jobs must be installed and running to provide anomaly data.
If data is missing:
- If the Run job link is displayed next to a machine learning job, it’s installed but not running. Click the link to go to the Anomaly Detection Jobs page, where you can run the job.
- If the uninstalled link is displayed next to a machine learning job, it needs to be installed and started. Click the link to find out how to do this.
Interact with the table to view more details:
- Click View all host anomalies to go to the Anomalies table on the Hosts page.
- Click View all user anomalies to go to the Anomalies table on the Users page.
- Click View all to display and manage all machine learning jobs on the Anomaly Detection Jobs page.
To learn more about machine learning, refer to What is Elastic machine learning?