You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
[Security Solution] [Bug] User Risk Score under Risk Scores table does not reset to zero when there are no alerts in lookback time period with Retain previously calculated risk scores disabled. #238431
Describe the bug User Risk Score under Risk Scores table does not reset to zero when there are no alerts in lookback time period with Retain previously calculated risk scores disabled.
Retain previously calculated risk scores should be disabled
No Alerts should be present in look back time period for Risk Score.
Steps to reproduce
Navigate to Security -> Entity Analytics -> Overview.
Under Entity Analytics Dashboard, Observe that User Risk Score under Risk Scores table does not reset to zero when there are no alerts in lookback time period with Retain previously calculated risk scores disabled.
Click on any Host/User Entity to open Details Flyout.
Observe that Risk Score will be shown as 0 however the same is not shown under User Risk Score column.
Expected Results User/Host Risk Score under Risk Scores table should be reset to zero when there are no alerts in lookback time period with Retain previously calculated risk scores disabled.
Describe the bug
User Risk Scoreunder Risk Scores table does not reset to zero when there are no alerts in lookback time period withRetain previously calculated risk scoresdisabled.Kibana/Elasticsearch Stack version
Pre Conditions
Retain previously calculated risk scoresshould be disabledSteps to reproduce
Security->Entity Analytics->Overview.User Risk Scoreunder Risk Scores table does not reset to zero when there are no alerts in lookback time period withRetain previously calculated risk scoresdisabled.User Risk Scorecolumn.Expected Results
User/Host Risk Scoreunder Risk Scores table should be reset to zero when there are no alerts in lookback time period withRetain previously calculated risk scoresdisabled.Observation
Screen.Recording.2025-10-10.at.5.45.51.PM.mov