Skip to content

Commit effa48a

Browse files
joepeeplesjoepeeples
committed
Merge remote-tracking branch 'staging-serverless-security-docs/closing-time-every-new-beginning' into migration-test2
2 parents cdda1d2 + b5ff7ca commit effa48a

File tree

506 files changed

+16852
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

506 files changed

+16852
-0
lines changed

‎.github/CODEOWNERS

+1
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
11
* @elastic/security-docs
2+
/.github/workflows/ @elastic/docs-engineering

‎.github/workflows/docs-elastic-staging-publish.yml

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
name: Staging Docs
2+
3+
on:
4+
pull_request_target:
5+
paths:
6+
- '**.mdx'
7+
- '**.docnav.json'
8+
- '**.docapi.json'
9+
- '**.devdocs.json'
10+
- '**.jpg'
11+
- '**.jpeg'
12+
- '**.png'
13+
- '**.svg'
14+
- '**.gif'
15+
types: [opened, closed, synchronize]
16+
17+
jobs:
18+
publish:
19+
name: Vercel Build Check
20+
uses: elastic/workflows/.github/workflows/docs-elastic-co-publish.yml@main
21+
secrets:
22+
VERCEL_GITHUB_TOKEN: ${{ secrets.VERCEL_GITHUB_TOKEN }}
23+
VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
24+
VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
25+
VERCEL_PROJECT_ID_DOCS_CO: ${{ secrets.VERCEL_PROJECT_ID_DOCS_CO }}

‎.gitignore

+1
Original file line numberDiff line numberDiff line change
@@ -2,3 +2,4 @@
22
docs/html_docs
33
/html_docs
44
.vscode/
5+
.vs/

‎docs/serverless/advanced-entity-analytics/advanced-behavioral-detections.mdx

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
id: serverlessSecurityAdvancedBehavioralDetections
3+
slug: /serverless/security/advanced-behavioral-detections
4+
title: Advanced behavioral detections
5+
description: Learn about advanced behavioral detections and its capabilities.
6+
tags: [ 'serverless', 'security', 'overview', 'analyze' ]
7+
status: in review
8+
---
9+
10+
<DocBadge template="technical preview" />
11+
12+
Elastic's ((ml)) capabilities and advanced correlation, scoring, and visualization techniques can help you identify potential behavioral threats that may be associated with security incidents.
13+
14+
Advanced behavioral detections includes two key capabilities:
15+
16+
* <DocLink id="serverlessSecurityMachineLearning">Anomaly detection</DocLink>
17+
* <DocLink id="serverlessSecurityBehavioralDetectionUseCases" />

‎docs/serverless/advanced-entity-analytics/advanced-entity-analytics-overview.mdx

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
id: serverlessSecurityAdvancedEntityAnalytics
3+
slug: /serverless/security/advanced-entity-analytics
4+
title: Advanced Entity Analytics
5+
description: Learn about Advanced Entity Analytics and its capabilities.
6+
tags: [ 'serverless', 'security', 'overview', 'analyze' ]
7+
status: in review
8+
---
9+
10+
<DocBadge template="technical preview" />
11+
12+
Advanced Entity Analytics generates a set of threat detection and risk analytics that allows you to expedite alert triage and hunt for new threats from within an entity's environment. This feature combines the power of the SIEM detection engine and Elastic's ((ml)) capabilities to identify unusual user behaviors and generate comprehensive risk analytics for hosts and users.
13+
14+
Advanced Entity Analytics provides two key capabilities:
15+
16+
* <DocLink id="serverlessSecurityEntityRiskScoring" />
17+
* <DocLink id="serverlessSecurityAdvancedBehavioralDetections" />

‎docs/serverless/advanced-entity-analytics/analyze-risk-score-data.mdx

+127
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
---
2+
id: serverlessSecurityAnalyzeRiskScoreData
3+
slug: /serverless/security/analyze-risk-score-data
4+
title: View and analyze risk score data
5+
description: Monitor risk score changes of hosts and users in your environment.
6+
tags: [ 'serverless', 'security', 'how-to', 'analyze' ]
7+
status: in review
8+
---
9+
10+
<DocBadge template="technical preview" />
11+
12+
The ((security-app)) provides several options to monitor the change in the risk posture of hosts and users from your environment. Use the following places in the ((security-app)) to view and analyze risk score data:
13+
14+
* <DocLink id="serverlessSecurityAnalyzeRiskScoreData" section="entity-analytics-dashboard">Entity Analytics dashboard</DocLink>
15+
* <DocLink id="serverlessSecurityAnalyzeRiskScoreData" section="alerts-page">Alerts page</DocLink>
16+
* <DocLink id="serverlessSecurityAnalyzeRiskScoreData" section="alert-details-flyout">Alert details flyout</DocLink>
17+
* <DocLink id="serverlessSecurityAnalyzeRiskScoreData" section="hosts-and-users-pages">Hosts and Users pages</DocLink>
18+
* <DocLink id="serverlessSecurityAnalyzeRiskScoreData" section="host-and-user-details-pages">Host and user details pages</DocLink>
19+
* <DocLink id="serverlessSecurityAnalyzeRiskScoreData" section="host-and-user-details-flyouts">Host and user details flyouts</DocLink>
20+
21+
22+
<DocCallOut title="Tip">
23+
We recommend that you prioritize <DocLink id="serverlessSecurityAnalyzeRiskScoreData" section="alert-triaging">alert triaging</DocLink> to identify anomalies or abnormal behavior patterns.
24+
</DocCallOut>
25+
26+
## Entity Analytics dashboard
27+
28+
From the Entity Analytics dashboard, you can access entity key performance indicators (KPIs), risk scores, and levels. You can also click the number link in the **Alerts** column to investigate and analyze the alerts on the Alerts page.
29+
30+
![Entity Analytics dashboard](../images/detection-entity-dashboard/-dashboards-entity-dashboard.png)
31+
32+
## Alert triaging
33+
You can prioritize alert triaging to analyze alerts associated with risky or business-critical entities using the following features in the ((security-app)).
34+
35+
### Alerts page
36+
37+
Use the Alerts table to investigate and analyze:
38+
39+
* Host and user risk levels
40+
* Host and user risk scores
41+
* Asset criticality
42+
43+
To display entity risk score and asset criticality data in the Alerts table, select **Fields**, and add the following:
44+
45+
* `user.risk.calculated_level` or `host.risk.calculated_level`
46+
* `user.risk.calculated_score_norm` or `host.risk.calculated_score_norm`
47+
* `user.asset.criticality` or `host.asset.criticality`
48+
49+
Learn more about <DocLink id="serverlessSecurityAlertsUiManage" section="customize-the-alerts-table">customizing the Alerts table</DocLink>.
50+
51+
![Risk scores in the Alerts table](../images/analyze-risk-score-data/alerts-table-rs.png)
52+
53+
#### Triage alerts associated with high-risk or business-critical entities
54+
55+
To analyze alerts associated with high-risk or business-critical entities, you can filter or group them by entity risk level or asset criticality level.
56+
57+
<DocCallOut title="Note">
58+
If you change the entity's criticality level after an alert is generated, that alert document will include the original criticality level and will not reflect the new criticality level.
59+
</DocCallOut>
60+
61+
* Use the drop-down filter controls to filter alerts by entity risk level or asset criticality level. To do this, <DocLink id="serverlessSecurityAlertsUiManage" section="edit-drop-down-filter-controls">edit the default controls</DocLink> to filter by:
62+
63+
* `user.risk.calculated_level` or `host.risk.calculated_level` for entity risk level:
64+
65+
![Alerts filtered by high host risk level](../images/analyze-risk-score-data/filter-by-host-risk-level.png)
66+
67+
* `user.asset.criticality` or `host.asset.criticality` for asset criticality level:
68+
69+
![Filter alerts by asset criticality level](../images/analyze-risk-score-data/filter-by-asset-criticality.png)
70+
71+
* To group alerts by entity risk level or asset criticality level, select **Group alerts by**, then select **Custom field** and search for:
72+
73+
* `host.risk.calculated_level` or `user.risk.calculated_level` for entity risk level:
74+
75+
![Alerts grouped by host risk levels](../images/analyze-risk-score-data/group-by-host-risk-level.png)
76+
77+
* `host.asset.criticality` or `user.asset.criticality` for asset criticality level:
78+
79+
![Alerts grouped by entity asset criticality levels](../images/analyze-risk-score-data/group-by-asset-criticality.png)
80+
81+
* You can further sort the grouped alerts by highest entity risk score:
82+
83+
1. Expand a risk level group (for example, **High**) or an asset criticality group (for example, **high_impact**).
84+
1. Select **Sort fields** → **Pick fields to sort by**.
85+
1. Select fields in the following order:
86+
1. `host.risk.calculated_score_norm`or `user.risk.calculated_score_norm`: **High-Low**
87+
1. `Risk score`: **High-Low**
88+
1. `@timestamp`: **New-Old**
89+
90+
![High-risk alerts sorted by host risk score](../images/analyze-risk-score-data/hrl-sort-by-host-risk-score.png)
91+
92+
### Alert details flyout
93+
94+
To access risk score data in the alert details flyout, select **Insights** → **Entities** on the **Overview** tab:
95+
96+
![Risk scores in the Alerts flyout](../images/analyze-risk-score-data/alerts-flyout-rs.png)
97+
98+
### Hosts and Users pages
99+
100+
On the Hosts and Users pages, you can access the risk score data:
101+
102+
* In the **Host risk level** or **User risk level** column on the **All hosts** or **All users** tab:
103+
104+
![Host risk level data on the All hosts tab of the Hosts page](../images/analyze-risk-score-data/hosts-hr-level.png)
105+
106+
* On the **Host risk** or **User risk** tab:
107+
108+
![Host risk data on the Host risk tab of the Hosts page](../images/analyze-risk-score-data/hosts-hr-data.png)
109+
110+
### Host and user details pages
111+
112+
On the host details and user details pages, you can access the risk score data:
113+
114+
* In the Overview section:
115+
116+
![Host risk data in the Overview section of the host details page](../images/analyze-risk-score-data/host-details-overview.png)
117+
118+
* On the **Host risk** or **User risk** tab:
119+
120+
![Host risk data on the Host risk tab of the host details page](../images/analyze-risk-score-data/host-details-hr-tab.png)
121+
122+
### Host and user details flyouts
123+
124+
In the host details and user details flyouts, you can access the risk score data in the risk summary section:
125+
126+
![Host risk data in the Host risk summary section](../images/analyze-risk-score-data/risk-summary.png)
127+

‎docs/serverless/advanced-entity-analytics/asset-criticality.mdx

+114
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
---
2+
id: serverlessSecurityAssetCriticality
3+
slug: /serverless/security/asset-criticality
4+
title: Asset criticality
5+
description: Learn how to use asset criticality to improve your security operations.
6+
tags: [ 'serverless', 'security', 'overview', 'analyze' ]
7+
status: in review
8+
---
9+
10+
<DocBadge template="technical preview" />
11+
12+
<DocCallOut title="Requirements">
13+
To view and assign asset criticality, you must:
14+
* Have the appropriate user role.
15+
* Turn on the `securitySolution:enableAssetCriticality` <DocLink id="serverlessSecurityAdvancedSettings" section="enable-asset-criticality-workflows" >advanced setting</DocLink>.
16+
17+
For more information, refer to <DocLink id="serverlessSecurityERSRequirements">Entity risk scoring prerequisites</DocLink>.
18+
</DocCallOut>
19+
20+
The asset criticality feature allows you to classify your organization's entities based on various operational factors that are important to your organization. Through this classification, you can improve your threat detection capabilities by focusing your alert triage, threat-hunting, and investigation activities on high-impact entities.
21+
22+
You can assign one of the following asset criticality levels to your entities, based on their impact:
23+
24+
* Low impact
25+
* Medium impact
26+
* High impact
27+
* Extreme impact
28+
29+
For example, you can assign **Extreme impact** to business-critical entities, or **Low impact** to entities that pose minimal risk to your security posture.
30+
31+
## View and assign asset criticality
32+
33+
Entities do not have a default asset criticality level. You can either assign asset criticality to your entities individually, or <DocLink id="serverlessSecurityAssetCriticality" section="bulk-assign-asset-criticality">bulk assign</DocLink> it to multiple entities by importing a text file.
34+
35+
When you assign, change, or unassign an individual entity's asset criticality level, that entity's risk score is immediately recalculated.
36+
37+
<DocCallOut title="Note">
38+
If you assign asset criticality using the file import feature, risk scores are **not** immediately recalculated. The newly assigned or updated asset criticality levels will impact entity risk scores during the next hourly risk scoring calculation.
39+
</DocCallOut>
40+
41+
You can view, assign, change, or unassign asset criticality from the following places in the ((elastic-sec)) app:
42+
43+
* The <DocLink id="serverlessSecurityHostsOverview" section="host-details-page">host details page</DocLink> and <DocLink id="serverlessSecurityUsersPage" section="user-details-page">user details page</DocLink>:
44+
45+
![Assign asset criticality from the host details page](../images/asset-criticality/-assign-asset-criticality-host-details.png)
46+
47+
* The <DocLink id="serverlessSecurityHostsOverview" section="host-details-flyout">host details flyout</DocLink> and <DocLink id="serverlessSecurityUsersPage" section="user-details-flyout">user details flyout</DocLink>:
48+
49+
![Assign asset criticality from the host details flyout](../images/asset-criticality/-assign-asset-criticality-host-flyout.png)
50+
51+
* The host details flyout and user details flyout in <DocLink id="serverlessSecurityTimelinesUi">Timeline</DocLink>:
52+
53+
![Assign asset criticality from the host details flyout in Timeline](../images/asset-criticality/-assign-asset-criticality-timeline.png)
54+
55+
### Bulk assign asset criticality
56+
57+
You can bulk assign asset criticality to multiple entities by importing a CSV, TXT or TSV file from your asset management tools.
58+
59+
The file must contain three columns, with each entity record listed on a separate row:
60+
61+
1. The first column should indicate whether the entity is a `host` or a `user`.
62+
1. The second column should specify the entity's `host.name` or `user.name`.
63+
1. The third column should specify one of the following asset criticality levels:
64+
* `extreme_impact`
65+
* `high_impact`
66+
* `medium_impact`
67+
* `low_impact`
68+
69+
The maximum file size is 1 MB.
70+
71+
File structure example:
72+
73+
```
74+
user,user-001,low_impact
75+
user,user-002,medium_impact
76+
host,host-001,extreme_impact
77+
````
78+
79+
To import a file:
80+
1. Go to **Project Settings** → **Stack Management** → **Asset criticality**.
81+
1. Select or drag and drop the file you want to import.
82+
83+
<DocCallOut title="Note">
84+
The file validation step highlights any lines that don't follow the required file structure. The asset criticality levels for those entities won't be assigned. We recommend that you fix any invalid lines and re-upload the file.
85+
</DocCallOut>
86+
87+
1. Click **Assign**.
88+
89+
This process overwrites any previously assigned asset criticality levels for the entities included in the imported file. The newly assigned or updated asset criticality levels are immediately visible within all asset criticality workflows and will impact entity risk scores during the next risk scoring calculation.
90+
91+
## Improve your security operations
92+
93+
With asset criticality, you can improve your security operations by:
94+
95+
* <DocLink id="serverlessSecurityAssetCriticality" section="prioritize-open-alerts">Prioritizing open alerts</DocLink>
96+
* <DocLink id="serverlessSecurityAssetCriticality" section="monitor-an-entitys-risk">Monitoring an entity's risk</DocLink>
97+
98+
### Prioritize open alerts
99+
100+
You can use asset criticality as a prioritization factor when triaging alerts and conducting investigations and response activities.
101+
102+
Once you assign a criticality level to an entity, all subsequent alerts related to that entity are enriched with its criticality level. This additional context allows you to <DocLink id="serverlessSecurityAnalyzeRiskScoreData" section="triage-alerts-associated-with-high-risk-or-business-critical-entities">prioritize alerts associated with business-critical entities</DocLink>.
103+
104+
### Monitor an entity's risk
105+
106+
The risk scoring engine dynamically factors in an entity's asset criticality, along with `Open` and `Acknowledged` detection alerts to <DocLink id="serverlessSecurityEntityRiskScoring" section="how-is-risk-score-calculated">calculate the entity's overall risk score</DocLink>. This dynamic risk scoring allows you to monitor changes in the risk profiles of your most sensitive entities, and quickly escalate high-risk threats.
107+
108+
To view the impact of asset criticality on an entity's risk score, follow these steps:
109+
110+
1. Open the <DocLink id="serverlessSecurityHostsOverview" section="host-details-flyout">host details flyout</DocLink> or <DocLink id="serverlessSecurityUsersPage" section="user-details-flyout">user details flyout</DocLink>. The risk summary section shows asset criticality's contribution to the overall risk score.
111+
1. Click **View risk contributions** to open the flyout's left panel.
112+
1. In the **Risk contributions** section, verify the entity's criticality level from the time the alert was generated.
113+
114+
![View asset criticality impact on host risk score](../images/asset-criticality/-asset-criticality-impact.png)

‎docs/serverless/advanced-entity-analytics/behavioral-detection-use-cases.mdx

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
---
2+
id: serverlessSecurityBehavioralDetectionUseCases
3+
slug: /serverless/security/behavioral-detection-use-cases
4+
title: Behavioral detection use cases
5+
description: Detect internal and external threats using behavioral detection integrations.
6+
tags: [ 'serverless', 'security', 'overview', 'analyze' ]
7+
status: in review
8+
---
9+
10+
<DocBadge template="technical preview" />
11+
12+
Behavioral detection identifies potential internal and external threats based on user and host activity. It uses a threat-centric approach to flag suspicious activity by analyzing patterns, anomalies, and context enrichment.
13+
14+
The behavioral detection feature is built on ((elastic-sec))'s foundational SIEM detection capabilities, leveraging ((ml)) algorithms to enable proactive threat detection and hunting.
15+
16+
## Elastic integrations for behavioral detection use cases
17+
18+
Behavioral detection integrations provide a convenient way to enable behavioral detection capabilities. They streamline the deployment of components that implement behavioral detection, such as data ingestion, transforms, rules, ((ml)) jobs, and scripts.
19+
20+
<DocCallOut title="Requirements">
21+
* Behavioral detection integrations require the Security Analytics Complete <DocLink id="serverlessGeneralManageProject">project feature</DocLink>.
22+
* To learn more about the requirements for using ((ml)) jobs, refer to <DocLink id="serverlessSecurityMlRequirements" />.
23+
</DocCallOut>
24+
25+
Here's a list of integrations for various behavioral detection use cases:
26+
27+
* [Data Exfiltration Detection](((integrations-docs))/ded)
28+
* [Domain Generation Algorithm Detection](((integrations-docs))/dga)
29+
* [Lateral Movement Detection](((integrations-docs))/lmd)
30+
* [Living off the Land Attack Detection](((integrations-docs))/problemchild)
31+
* [Network Beaconing Identification](((integrations-docs))/beaconing)
32+
33+
To learn more about ((ml)) jobs enabled by these integrations, refer to [Prebuilt job reference](((security-guide))/prebuilt-ml-jobs.html).

0 commit comments

Comments
 (0)