[Request] Update docs for automatic risk scoring after asset criticality assignment

[jaredburgettelastic]

Description

What?

We are introducing the ability to immediately recalculate an individual entity's risk score upon changing its asset criticality assignment. Currently, the docs state that the user must wait until the next risk scoring background process for the new criticality to be taken into account, and this should now change.

Why?

It is confusing for users to update their criticality assignment and not see it immediately reflected in risk scoring. This bug originally showed this behavior as undesirable.

Background & resources

• PRs:
  • [SecuritySolution] [UI] Re-score entity when asset criticality changes kibana#182234
  • [SecuritySolution] - Create API that calculates the risk score for an Entity kibana#181715
• Issues/metas:
  • https://github.com/elastic/security-team/issues/9121
• Point of contact: @machadoum or @jaredburgettelastic
• Test environments: not yet merged and no environment created yet, will add once available

Which documentation set does this change impact?

ESS and serverless

ESS release

8.15

Serverless release

The week of May 20th

Feature differences

N/A

API docs impact

N/A

Prerequisites, privileges, feature flags

Asset Criticality advanced setting must be enabled, and Risk Scoring Engine must be enabled (note that both of these are already called out appropriately in the current docs, no changes needed from this perspective).

[natasha-moore-elastic]

@jaredburgettelastic just to clarify, does this only apply to changing asset criticality from one level to another (for example, low impact -> high impact), or does it also apply to assigning a criticality level for the first time (unassigned -> low impact) and unassigning asset criticality (low impact -> unassigned)? Is the risk score immediately recalculated in all of those scenarios?

[jaredburgettelastic]

@natasha-moore-elastic This applies to any asset criticality changes made directly through the UI on an individual entity, whether assignment, unassignment, or update.

However, this does not apply to the CSV file upload feature. Any asset criticality changes made through that mechanism currently only affect the next run of the risk engine.