You are viewing docs on Elastic's new documentation system, currently in technical preview. For all other Elastic docs, visit

Turn on the risk scoring engine

Start generating host and user risk scores.


To use entity risk scoring, you must have the appropriate user role. For more information, refer to Entity risk scoring prerequisites.

The risk scoring engine runs hourly to aggregate Open and Acknowledged alerts from the last 30 days, and assigns risk score to the host or user. It then aggregates the individual risk scores and normalizes them to a 0-100 range. The engine assigns a risk level by mapping the normalized risk score to one of these levels:

Risk levelRisk score
< 20
> 90

Preview risky entities

You can preview risky entities before installing the risk engine. The preview shows the riskiest hosts and users found in the 1000 sampled entities during the time frame selected in the date picker.


The preview is limited to two risk scores per serverless Security project.

To preview risky entities, go to Project settingsManagementEntity Risk Score:

Turn on the risk engine


To view risk score data, you must have alerts generated in your environment.

If you're installing the risk scoring engine for the first time:

  1. Go to Project settingsManagementEntity Risk Score.
  2. Turn the Entity risk score toggle on.

On this page