You are viewing docs on Elastic's new documentation system, currently in technical preview. For all other Elastic docs, visit

View and analyze risk score data

Monitor risk score changes of hosts and users in your environment.

The Elastic Security app provides several options to monitor the change in the risk posture of hosts and users from your environment. Use the following places in the Elastic Security app to view and analyze risk score data:


We recommend that you prioritize alert triaging to identify anomalies or abnormal behavior patterns.

Entity Analytics dashboard

From the Entity Analytics dashboard, you can access entity key performance indicators (KPIs), risk scores, and levels. You can also click the number link in the Alerts column to investigate and analyze the alerts on the Alerts page.

Alert triaging

You can prioritize alert triaging to analyze alerts associated with risky entities using the following features in the Elastic Security app.

Alerts page

Use the Alerts table to investigate and analyze host and user risk levels and scores. We recommend adding the user.risk.calculated_level and host.risk.calculated_level columns to the Alerts table to easily display this data. To do this, select Fields, search for user.risk and host.risk, then select the appropriate fields from the list. Learn more about customizing the Alerts table.

You can use the drop-down filter controls to filter alerts by their risk score level. To do this, edit the default controls to filter by user.risk.calculated_level or host.risk.calculated_level:

Alert details flyout

To access risk score data in the alert details flyout, select InsightsEntities on the Overview tab:

Hosts and Users pages

On the Hosts and Users pages, you can access the risk score data:

  • In the Host risk level or User risk level column on the All hosts or All users tab:

  • On the Host risk or User risk tab:

Host and user details pages

On the host details and user details pages, you can access the risk score data:

  • In the Overview section:

  • On the Host risk or User risk tab:

On this page