Skip to content

Commit a9956f8

Browse files
jmikell821github-actions[bot]
authored andcommitted
Fixing doc bugs reported by QA. (#2065)
Co-authored-by: Craig Chamberlain <[email protected]> (cherry picked from commit 13c63ce)
1 parent 95feaf0 commit a9956f8

File tree

1 file changed

+4
-13
lines changed

1 file changed

+4
-13
lines changed

docs/experimental-machine-learning/user-risk-score.md

Lines changed: 4 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -7,13 +7,13 @@ User Risk Score is an experimental feature that assigns risk scores to usernames
77

88
### On Usernames and Risk Scores
99

10-
Many alerts contain usernames which were present in the original log or event documents that alert rules, or anomaly rules, matched. These are discrete usernames, not (yet) pointers to a user *entity*. In most environments, each human user has multiple usernames across the various applications and systems they use. In order to investigate a user, it may be necessary to add each of their usernames to the list of usernames being used to filter the output of the detail dashboard.
10+
Many alerts contain usernames which were present in the original log or event documents that alert rules, or anomaly rules, matched. These are discrete usernames, not (yet) pointers to a user *entity*. In most environments, each human user has multiple usernames across the various applications and systems they use. In order to investigate a user, it may be necessary to add each of their usernames to the list of usernames being used to filter the output of the detail dashboard.
1111

12-
In some cases, there are certain usernames that are not readily individuated. The Local System, or SYSTEM account, under Windows, for example, has the same name and the same SID (security identifier) on every Windows host. In order to individuate a particular Local System user account, it is necessary to add its hostname as a filter. The user risk score detail dashboard contains tables of alerts by hostname, in addition to username, in order to help identify the hostname(s) associated with a local user that has been given a risk score.
12+
In some cases, there are certain usernames that are not readily individuated. The Local System, or SYSTEM account, under Windows, for example, has the same name and the same SID (security identifier) on every Windows host. In order to individuate a particular Local System user account, it is necessary to add its hostname as a filter. The user risk score detail dashboard contains tables of alerts by hostname, in addition to username, in order to help identify the hostname(s) associated with a local user that has been given a risk score.
1313

1414
## Setup Instructions
1515

16-
1. [Obtain artifacts](#obtain-artifacts)
16+
1. [Obtain artifacts](#obtain-artifacts)
1717
2. [Upload scripts](#upload-scripts)
1818
3. [Upload ingest pipeline](#upload-ingest-pipeline)
1919
4. [Upload and start the `pivot` transform](#upload-start-pivot)
@@ -61,13 +61,6 @@ PUT _scripts/ml_userriskscore_reduce_script_&lt;your-space-name&gt;
6161
{contents of ml_userriskscore_reduce_script.json file}
6262
</code></pre></div>
6363

64-
<i>For Elastic Stack version 8.1+ only</i>
65-
<div style="margin-left: 40px">
66-
<pre><code>
67-
PUT _scripts/ml_userriskscore_init_script_&lt;your-space-name&gt;
68-
{contents of ml_userriskscore_init_script.json file}
69-
</code></pre></div>
70-
7164

7265
<h3 id="upload-ingest-pipeline">3. Upload ingest pipeline</h3>
7366

@@ -76,7 +69,7 @@ PUT _scripts/ml_userriskscore_init_script_&lt;your-space-name&gt;
7669

7770
<div style="margin-left: 40px">
7871
<i>uploading ingest pipeline</i>
79-
<pre style="margin-top:-2px"><code>PUT _ingest/pipeline/ml_usertriskscore_ingest_pipeline_&lt;your-space-name&gt;
72+
<pre style="margin-top:-2px"><code>PUT _ingest/pipeline/ml_userriskscore_ingest_pipeline_&lt;your-space-name&gt;
8073
{contents of ml_userriskscore_ingest_pipeline.json file}
8174
</code></pre></div>
8275

@@ -166,5 +159,3 @@ https://www.elastic.co/guide/en/cloud-enterprise/current/ece-manage-kibana-setti
166159
Once you have modified the `kibana.yml` file, you will find User Risk Scoring features in the "User Risk" tab in the detail view for a username. The detail view is reached by clicking a username in the Users page in the Security Solution:
167160

168161
<hr/>
169-
170-

0 commit comments

Comments
 (0)