Elastic Announces Weighted Entity Watchlists for Security Risk Scoring
Summary
Elastic says Security v9.4 will add named, weighted watchlists for users, hosts, and services, feeding organizational context into entity risk scores. Lists can be managed manually or populated through integrations and APIs.
Key points
- Entity Analytics Watchlists let teams create named, described, rule-driven, or manually curated lists of users, hosts, services, and other entities with configurable risk weights.
- Watchlist membership contributes a weighted signal to entity risk scoring alongside alert activity, asset criticality, and behavioral anomalies.
- Suggested uses include monitoring departing employees, privileged users, critical infrastructure, newly acquired entities, and known-safe entities.
- Watchlists can be populated through integrations or APIs; the article gives an HR system updating offboarding status as an example.
- Elastic says the feature avoids requiring ES|QL, pipeline configuration, or detection engineering tickets, and is for customers with Entity analytics enabled.
Article Details
- Event Type
- Product feature announcement: Elastic Security announced Entity Analytics Watchlists for version 9.4.
- Impact
- Watchlists let teams assign configurable risk weightings to selected users, hosts, services, and other entities. Membership contributes to entity risk scores alongside alerts, asset criticality, and behavioral anomalies, helping prioritize investigations and incorporate organizational context without ES|QL or pipeline configuration. The article says the feature is for customers with Entity analytics enabled; it describes the v9.4 release as upcoming.
Vendors
Products
Elastic SecurityElastic Security v9.4 introduces Entity Analytics Watchlists, enabling teams to create named, weighted lists of users, hosts, and services and inject that context directly into the platform’s entity risk scoringEntity Analytics WatchlistsElastic Security v9.4 introduces Entity Analytics Watchlists, enabling teams to create named, weighted lists of users, hosts, and services and inject that context directly into the platform’s entity risk scoring