Configure entity profile

Entity Profile in Exposure Analytics uses rules to proactively identify contextual risk across assets and users based on their context and security posture. This helps security engineers prioritize exposure remediation and gives security analysts additional context during investigations. An entity's profile level can also increase the risk score of findings associated with that entity.

Entity Profile rules assign a profile level, one or more profile tags, or both to an asset or user. Each rule can use logic based on one or more posture metric gaps or saved discovery filters. When multiple rules are triggered for an entity, its profile level is the highest level assigned by those rules, and its profile tags are the combined tags from all triggered rules.

Risk factors are used to increase a finding's risk score based on the profile level of its associated entity. If the triggered rules assign only tags and no profile level, then the entity has no profile level and the finding's risk score is not increased based on Entity Profile.

Examples of entity profile rules might include:

Entity Profile levels and tags update dynamically based on the rules an entity matches. For example, an executive asset might be assigned a Critical profile level when it matches a rule that identifies an endpoint security gap. If the gap is resolved, the asset might no longer match the rule, and its profile level might change or be removed.

The table below outlines the steps to configure entity profile.