[Suggestion] The ERS requirements page should include the necessary privileges for installing and running the Risk Score Engine, as well as for using ingest pipelines

[abhishekbhatia1710]

What can we change to make the docs better?

Documentation is needed for both running and installing the Risk Score Engine, as they are distinct processes.

• Installing the Risk Score Engine requires:

  • manage_transform
  • manage_index_templates

• Running the Risk Score Engine requires:

  • manage_transform

Documentation is needed for privileges required to use ingest pipelines in the Risk Score Engine.

• manage_ingest_pipelines

Doc URL

Please include the doc URL and any other related information where applicable:
Doc URL: (https://www.elastic.co/guide/en/security/current/ers-requirements.html)
Github issue link(s)/Other resources:
For ingest pipeline privileges : https://github.com/elastic/security-team/issues/12010

Which documentation set needs improvement?

ESS and serverless

Software version

The functionality has been available since the introduction of Risk Score; however, the documentation needs refinement.

[natasha-moore-elastic]

Additional clarification on the privileges for running the engine:

Q: For running the risk scoring engine, do users need the same index and kibana privs as for enabling it?
A: Same kibana priv (Read for Security), but no index priv

Q: For running the risk scoring engine in serverless, what roles are needed?
A: For running the risk engine the serverless predefined roles are the same as for installing.

Q: Is using ingest pipelines required for enabling or running the risk engine?
A: Required for enabling. Note: if we add “manage_ingest_pipelines” to the requirement, the detections_admin role can't install the engine anymore.

[machadoum]

I think this one is slightly inaccurate:

Q: For running the risk scoring engine, do users need the same index and kibana privs as for enabling it?
A: Same kibana priv (Read for Security), but no index priv

The Google Docs says:
Answer: we need less cluster privileges - manage transform, and security read

So the correct answer would be:

Q: For running the risk scoring engine, do users need the same index and kibana privs as for enabling it?
A: Only manage_transform cluster priv, Read for Security and no index priv

[natasha-moore-elastic]

I think this one is slightly inaccurate:

Q: For running the risk scoring engine, do users need the same index and kibana privs as for enabling it?
A: Same kibana priv (Read for Security), but no index priv

The Google Docs says: Answer: we need less cluster privileges - manage transform, and security read

So the correct answer would be:

Q: For running the risk scoring engine, do users need the same index and kibana privs as for enabling it?
A: Only manage_transform cluster priv, Read for Security and no index priv

Hey @machadoum – my question here was related to index and kibana privs only – Abhishek had already covered the cluster priv in the issue description :)

• Running the Risk Score Engine requires:
  • manage_transform