Adds new Advanced Behavioral Detections section #4296

natasha-moore-elastic · 2023-11-16T15:57:00Z

Contributes to #4227.

Summary of changes:

The 'Entity Risk Scoring' section has been moved and is now a child page of 'Advanced Entity Analytics'.
The 'Turn on the risk scoring engine' and 'View and analyze risk score data' pages have been moved and are now child pages of the new 'Entity Risk Scoring' page.
A new 'Advanced Behavioral Detections' page has been added as a child page of 'Advanced Entity Analytics'.
Existing 'Anomaly detection with machine learning' page has been renamed to 'Anomaly detection' and is now a child page of 'Advanced Behavioral Detections'.
New 'Behavioral detection use cases' page has been added as a child page of 'Advanced Behavioral Detections'.
The 'Jobs in Advanced Analytics (UEBA) Elastic integrations' section has been renamed to 'Elastic Integrations for behavioral detection use cases' and moved to the new 'Behavioral detection use cases' page.
'Prebuilt job reference' and 'Optimizing anomaly results' are now child pages of 'Advanced Behavioral Detections' (since they couldn't be nested under 'Anomaly detection' due to page level limitations in the TOC).

Previews:

github-actions · 2023-11-16T15:57:13Z

Documentation previews:

✨ HTML diff
📙 Elastic Security Guide

mergify · 2023-11-21T13:21:45Z

This pull request is now in conflicts. Could you fix it @natasha-moore-elastic? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b issue-4227-adv-beh-det upstream/issue-4227-adv-beh-det
git merge upstream/main
git push upstream issue-4227-adv-beh-det

benironside

I know this PR was mostly focused on reorg, but I ended up editing some of content that got moved. A few things jumped out at me, so I left some suggestions for your consideration. Feel free to take them with a grain of salt, I am certainly not the most informed about this set of features. Hope they're helpful, lmk if anything doesn't make sense.

docs/advanced-entity-analytics/advanced-behavioral-detections.asciidoc

docs/advanced-entity-analytics/behavioral-detection-use-cases.asciidoc

docs/advanced-entity-analytics/entity-risk-scoring.asciidoc

benironside · 2023-11-29T21:49:47Z

docs/advanced-entity-analytics/entity-risk-scoring.asciidoc

+
+The next-generation risk scoring engine provides greater scalability and performance. It leverages the Elastic SIEM detection engine to generate host and user risk scores from the last 30 days.
+
+It also generates risk scores on a recurring interval, and allows for easy onboarding and management. The engine is built to factor in risks from all {elastic-sec} use cases, and allows you to customize and control how and when risk is calculated.


Suggested change

It also generates risk scores on a recurring interval, and allows for easy onboarding and management. The engine is built to factor in risks from all {elastic-sec} use cases, and allows you to customize and control how and when risk is calculated.

It also generates risk scores on a recurring interval, and allows for easy onboarding and management. The engine is built to factor in risks from all {elastic-sec} use cases, and allows you to customize and control how and when risk is calculated.

"data from... use-cases" seems off to me. Maybe replace with "Data from various sources" or "Data from across SIEM"?

I'm not sure which sentence this suggestion refers to? There's no mention of 'data' in this paragraph.

Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com>

jmikell821

Hi @natasha-moore-elastic - lots of good feedback here, but we could definitely use @SourinPaul's help to address some of the questions. Incorporate what you can, and once feedback is completely merged we'll do a final pass-through. Thanks for pulling this together!

docs/advanced-entity-analytics/behavioral-detection-use-cases.asciidoc

docs/advanced-entity-analytics/entity-risk-scoring.asciidoc

docs/advanced-entity-analytics/advanced-behavioral-detections.asciidoc

SourinPaul

Consider the comments. Looks great.

natasha-moore-elastic · 2023-12-04T17:48:39Z

@elasticmachine run elasticsearch-ci/docs

jmikell821 · 2023-12-05T03:50:23Z

@elasticmachine run elasticsearch-ci/docs

natasha-moore-elastic · 2023-12-05T09:28:45Z

It looks like the build is failing due to:

04:05:07 INFO:build_docs:Bad cross-document links:
04:05:07 INFO:build_docs:  Kibana [master]: packages/kbn-doc-links/src/get_doc_links.ts contains broken links to:
04:05:07 INFO:build_docs:   - en/security/master/advanced-entity-analytics-overview.html#entity-risk-scoring

@hop-dev, I see that in this PR we added a link to advanced-entity-analytics-overview.html#entity-risk-scoring. We're restructuring the documentation, and Entity risk scoring will be a separate page (entity-risk-scoring.html) once this PR is merged. Could we update the link in the packages/kbn-doc-links/src/get_doc_links.ts file to point to this new location? Hopefully, that should also unblock this build.

hop-dev · 2023-12-05T11:48:01Z

@natasha-moore-elastic here is the PR elastic/kibana#172560

natasha-moore-elastic · 2023-12-05T11:53:30Z

@natasha-moore-elastic here is the PR elastic/kibana#172560

Thanks for the quick turnaround, @hop-dev, I appreciate it!

@natasha-moore-elastic

…w page (#172560) Update: We are now setting the link to a temporary link to get elastic/security-docs#4296 merged and will then update to the new page As requested by @natasha-moore-elastic [here](elastic/security-docs#4296 (comment)) The entity risk scorign documentation is moving to a new page and we need to update this link to fix the build in elastic/security-docs#4296.

natasha-moore-elastic · 2023-12-05T15:59:38Z

@elasticmachine run elasticsearch-ci/docs

* Adds new Advanced Behavioral Detections section * Moves L4 pages to L3 * Moves ml-integrations under Behavioral detection use cases * Adds Advanced Behavioral Detections intro section * Adds links to AEA page * Uncomments reference that previously broke the build for no reason * Replaces verbal reference to ml-integrations * Removes frontmatter * Behavioral detection updates * Apply suggestions from code review Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com> * Apply suggestion from TW review * Applies review feedback * Lowercase advanced behavioral detections * Lowercase entity risk scoring --------- Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com> (cherry picked from commit e700a62)

* Adds new Advanced Behavioral Detections section * Moves L4 pages to L3 * Moves ml-integrations under Behavioral detection use cases * Adds Advanced Behavioral Detections intro section * Adds links to AEA page * Uncomments reference that previously broke the build for no reason * Replaces verbal reference to ml-integrations * Removes frontmatter * Behavioral detection updates * Apply suggestions from code review Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com> * Apply suggestion from TW review * Applies review feedback * Lowercase advanced behavioral detections * Lowercase entity risk scoring --------- Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com> (cherry picked from commit e700a62) Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com>

@natasha-moore-elastic

…e new page (#172592) Follow on from #172560 As requested by @natasha-moore-elastic elastic/security-docs#4296 (comment) The entity risk scoring documentation is moving to a new page and we need to update this link to fix the build in elastic/security-docs#4296.

Adds new Advanced Behavioral Detections section

47bf63e

natasha-moore-elastic added the v8.11.0 label Nov 16, 2023

natasha-moore-elastic self-assigned this Nov 16, 2023

natasha-moore-elastic added 2 commits November 16, 2023 17:36

Moves L4 pages to L3

6370d46

Moves ml-integrations under Behavioral detection use cases

3f5b51e

natasha-moore-elastic added 4 commits November 21, 2023 13:31

Adds Advanced Behavioral Detections intro section

b3fc7a3

Resolves conflict

04095f6

Adds links to AEA page

1e4c255

Uncomments reference that previously broke the build for no reason

ce01206

natasha-moore-elastic linked an issue Nov 21, 2023 that may be closed by this pull request

Entity Analytics: Create new "Advanced Behavioral Detections" topic #4227

Closed

natasha-moore-elastic added 3 commits November 21, 2023 14:20

Replaces verbal reference to ml-integrations

48982a0

Removes frontmatter

6f9953a

Behavioral detection updates

e8ad0e3

natasha-moore-elastic marked this pull request as ready for review November 29, 2023 14:36

natasha-moore-elastic requested a review from a team as a code owner November 29, 2023 14:36

natasha-moore-elastic requested a review from SourinPaul November 29, 2023 14:36

Merge branch 'main' into issue-4227-adv-beh-det

b9abe0a

benironside reviewed Nov 29, 2023

View reviewed changes

benironside requested a review from a team November 29, 2023 21:52

natasha-moore-elastic and others added 2 commits November 30, 2023 11:10

Apply suggestions from code review

a9f6d0b

Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com>

Apply suggestion from TW review

50da8f5

natasha-moore-elastic added the v8.12.0 label Nov 30, 2023

jmikell821 reviewed Dec 1, 2023

View reviewed changes

SourinPaul previously approved these changes Dec 2, 2023

View reviewed changes

SourinPaul requested a review from ajosh0504 December 2, 2023 01:23

Applies review feedback

d778f49

natasha-moore-elastic dismissed SourinPaul’s stale review via d778f49 December 4, 2023 11:56

Lowercase advanced behavioral detections

23ca78c

natasha-moore-elastic and others added 2 commits December 4, 2023 18:15

Merge branch 'main' into issue-4227-adv-beh-det

6011f8b

Lowercase entity risk scoring

1b59a35

hop-dev mentioned this pull request Dec 5, 2023

[Entity Analytics] Update Entity Risk Scoring doc link to point to new page elastic/kibana#172560

Merged

Merge branch 'main' into issue-4227-adv-beh-det

f9aea2f

hop-dev mentioned this pull request Dec 5, 2023

[Entity Analytics] Update Entity Risk Scoring doc link to point to the new page elastic/kibana#172592

Merged

jmikell821 approved these changes Dec 5, 2023

View reviewed changes

natasha-moore-elastic merged commit e700a62 into main Dec 5, 2023
3 of 4 checks passed

natasha-moore-elastic deleted the issue-4227-adv-beh-det branch December 5, 2023 16:44

mergify bot mentioned this pull request Dec 5, 2023

[8.11] Adds new Advanced Behavioral Detections section (backport #4296) #4389

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Adds new Advanced Behavioral Detections section #4296

Adds new Advanced Behavioral Detections section #4296

natasha-moore-elastic commented Nov 16, 2023 •

edited

Loading

github-actions bot commented Nov 16, 2023

mergify bot commented Nov 21, 2023

benironside left a comment

benironside Nov 29, 2023

natasha-moore-elastic Nov 30, 2023 •

edited

Loading

jmikell821 left a comment

SourinPaul left a comment

natasha-moore-elastic commented Dec 4, 2023

jmikell821 commented Dec 5, 2023

natasha-moore-elastic commented Dec 5, 2023 •

edited

Loading

hop-dev commented Dec 5, 2023

natasha-moore-elastic commented Dec 5, 2023

natasha-moore-elastic commented Dec 5, 2023


		The next-generation risk scoring engine provides greater scalability and performance. It leverages the Elastic SIEM detection engine to generate host and user risk scores from the last 30 days.

		It also generates risk scores on a recurring interval, and allows for easy onboarding and management. The engine is built to factor in risks from all {elastic-sec} use cases, and allows you to customize and control how and when risk is calculated.

Adds new Advanced Behavioral Detections section #4296

Adds new Advanced Behavioral Detections section #4296

Conversation

natasha-moore-elastic commented Nov 16, 2023 • edited Loading

github-actions bot commented Nov 16, 2023

mergify bot commented Nov 21, 2023

benironside left a comment

Choose a reason for hiding this comment

benironside Nov 29, 2023

Choose a reason for hiding this comment

natasha-moore-elastic Nov 30, 2023 • edited Loading

Choose a reason for hiding this comment

jmikell821 left a comment

Choose a reason for hiding this comment

SourinPaul left a comment

Choose a reason for hiding this comment

natasha-moore-elastic commented Dec 4, 2023

jmikell821 commented Dec 5, 2023

natasha-moore-elastic commented Dec 5, 2023 • edited Loading

hop-dev commented Dec 5, 2023

natasha-moore-elastic commented Dec 5, 2023

natasha-moore-elastic commented Dec 5, 2023

natasha-moore-elastic commented Nov 16, 2023 •

edited

Loading

natasha-moore-elastic Nov 30, 2023 •

edited

Loading

natasha-moore-elastic commented Dec 5, 2023 •

edited

Loading