Elastic Security's Entity Analytics (EA) provides a critical context for threat hunting by mapping users to hosts and resolving scattered accounts into single identities. Built on Entity Store v2, this system utilizes 'maintainers'—background jobs that continuously enrich entity records with data on relationships, identity resolution, and risk scores. Unlike traditional SIEMs that use flat snapshots, Elastic treats entities as living records updated via Elasticsearch Query Language (ES|QL), ensuring that data remains dynamic and queryable.
The process involves extracting data from telemetry like EDR and cloud logs, collapsing events into denormalized records, and assigning a deterministic Entity Unique ID (EUID). Maintainers add layers of intelligence, such as 'accesses_frequently' relationships and aggregated risk scores across resolved accounts. This transparent architecture allows analysts to inspect, correct, and extend entity data, ensuring that downstream AI reasoning and baselines are grounded in high-quality, verifiable identity information.
