[Security] Update entity details flyout UI labels

solutions/security/advanced-entity-analytics.md

@@ -80,7 +80,7 @@ stack: preview 9.4+
 serverless: preview
 ```
 
-Investigate entity connections and relationships directly from the entity details flyout. The overview panel shows a graph preview of the entity's connections over the last 30 days, and the **Graph View** tab in the expanded panel provides a full interactive investigation experience. Graph visualization requires [entity store](/solutions/security/advanced-entity-analytics/entity-store.md) to be enabled and populated in the active space.
+Investigate entity connections and relationships directly from the entity details flyout. The overview panel shows a graph preview of the entity's connections over the last 30 days, and the expanded panel provides a full interactive investigation experience. Graph visualization requires [entity store](/solutions/security/advanced-entity-analytics/entity-store.md) to be enabled and populated in the active space.
 
 ### Privileged user monitoring
 ```yaml {applies_to}

solutions/security/advanced-entity-analytics/asset-criticality.md

@@ -144,12 +144,6 @@ Risk scoring dynamically factors in an entity’s asset criticality, along with
 
 To view the impact of asset criticality on an entity’s risk score, follow these steps:
 
-1. Open the [entity details flyout](/solutions/security/advanced-entity-analytics/view-entity-details.md#entity-details-flyout). The risk summary section shows asset criticality’s contribution to the overall risk score.
-2. Click **View risk contributions** to open the flyout’s left panel.
-3. In the **Risk contributions** section, verify the entity’s criticality level from the time the alert was generated.
-
-:::{image} /solutions/images/security-asset-criticality-impact.png
-:alt: View asset criticality impact on host risk score
-:screenshot:
-:::
-
+1. Open the [entity details flyout](/solutions/security/advanced-entity-analytics/view-entity-details.md#entity-details-flyout). The risk score section shows asset criticality’s contribution to the overall risk score.
+2. Expand the risk score section to open the flyout’s left panel.
+3. In the **Contexts** section, verify the entity’s criticality level from the time the alert was generated.

solutions/security/advanced-entity-analytics/entity-resolution.md

@@ -29,7 +29,7 @@ A resolution group consists of:
 * **Primary entity**: The authoritative representation of the real-world identity. It receives aggregated risk scores that combine the risk from all linked records in the group. When an entity from an identity provider (Okta, Active Directory, or Entra ID) is linked with a local entity, the IDP entity is preferred as the primary entity.
 * **Alias entities**: Records that point to the primary entity via a `resolved_to` field. In the **Entities** section of the [Entity analytics page](/solutions/security/advanced-entity-analytics/monitor-entity-risk.md), alias entities appear nested under their primary entity when the table is grouped by **Resolution** (the default view).
 
-Resolution group relationships are also visible as **Resolved to** connections in the entity details flyout's [Graph View](/solutions/security/advanced-entity-analytics/view-entity-details.md#visualizations) tab.
+Resolution group relationships are also visible as **Resolved to** connections in the entity details flyout's [interactive graph](/solutions/security/advanced-entity-analytics/view-entity-details.md#visualizations).
 
 ## Automated resolution [entity-resolution-automated]
 
@@ -86,10 +86,4 @@ Bulk unlinking is not available in the UI; use the [Entity store API]({{kib-apis
 
 ### Manage resolution groups from the entity flyout [entity-resolution-flyout]
 
-You can view, add to, and remove entities from a resolution group directly from the [entity details flyout](/solutions/security/advanced-entity-analytics/view-entity-details.md#resolution). The flyout's **Resolution group** tab shows all linked records and lets you search for entities to add, or remove individual aliases.
-
-:::{image} /solutions/images/security-resolution-from-flyout.png
-:alt: Resolution group tab on the entity details flyout
-:screenshot:
-:::
-
+You can view, add to, and remove entities from a resolution group directly from the entity details flyout. Expand the [**Resolution** section](/solutions/security/advanced-entity-analytics/view-entity-details.md#resolution) to view all linked records, search for entities to add, or remove individual aliases.

solutions/security/advanced-entity-analytics/entity-risk-scoring.md

@@ -63,7 +63,7 @@ The resulting entity risk scores are stored in the `risk-score.risk-score-<space
     * By default, risk scoring uses the last 30 days of alerts. When turning on risk scoring, you can configure a different date and time range.
     ::::
 
-2. Alert risk scores (`kibana.alert.risk_score`) are aggregated for each entity, with entities identified by their Entity Unique Identifier (EUID) — a stable ID derived from ECS identity fields. Alerts with higher risk scores contribute more than those with lower risk scores. The resulting aggregated risk score is assigned to the **Alerts** category in the entity's [risk summary](/solutions/security/advanced-entity-analytics/view-entity-details.md#entity-risk-summary).
+2. Alert risk scores (`kibana.alert.risk_score`) are aggregated for each entity, with entities identified by their Entity Unique Identifier (EUID) — a stable ID derived from ECS identity fields. Alerts with higher risk scores contribute more than those with lower risk scores. The resulting aggregated risk score is assigned to the **Alerts** category in the entity's [risk score section](/solutions/security/advanced-entity-analytics/view-entity-details.md#risk-score).
 
 3. The score is then updated based on the following risk inputs:
 
@@ -111,7 +111,7 @@ When an entity belongs to a [resolution group](/solutions/security/advanced-enti
     * By default, risk scoring uses the last 30 days of alerts. When turning on risk scoring, you can configure a different date and time range.
     ::::
 
-2. The engine groups alerts by `host.name`, `user.name`, or `service.name`, and aggregates the individual alert risk scores (`kibana.alert.risk_score`) such that alerts with higher risk scores contribute more than alerts with lower risk scores. The resulting aggregated risk score is assigned to the **Alerts** category in the entity's [risk summary](/solutions/security/advanced-entity-analytics/view-entity-details.md#entity-risk-summary).
+2. The engine groups alerts by `host.name`, `user.name`, or `service.name`, and aggregates the individual alert risk scores (`kibana.alert.risk_score`) such that alerts with higher risk scores contribute more than alerts with lower risk scores. The resulting aggregated risk score is assigned to the **Alerts** category in the entity's [risk summary](/solutions/security/advanced-entity-analytics/view-entity-details.md#risk-score).
 
 3. The engine then updates the score based on the following risk inputs:
 

solutions/security/advanced-entity-analytics/entity-store.md

@@ -31,7 +31,7 @@ The entity store can hold any entity type observed by {{elastic-sec}}. It allows
 
 {applies_to}`stack: ga 9.4+` {applies_to}`serverless: ga` [Entity resolution](/solutions/security/advanced-entity-analytics/entity-resolution.md) is built on top of the entity store. It links multiple entity records representing the same real-world identity into a resolution group, consolidating their risk scores into a single view.
 
-{applies_to}`stack: preview 9.4+` {applies_to}`serverless: preview` [Entity relationships](/solutions/security/advanced-entity-analytics/entity-relationships.md) sourced from the entity store — such as access patterns, dependencies, and resolution links — are visible in the entity details flyout's [Graph View](/solutions/security/advanced-entity-analytics/view-entity-details.md#visualizations) tab. Entities that appear in both the entity store and in raw events are rendered as a single deduplicated node in the graph.
+{applies_to}`stack: preview 9.4+` {applies_to}`serverless: preview` [Entity relationships](/solutions/security/advanced-entity-analytics/entity-relationships.md) sourced from the entity store — such as access patterns, dependencies, and resolution links — are visible in the entity details flyout's [interactive graph](/solutions/security/advanced-entity-analytics/view-entity-details.md#visualizations). Entities that appear in both the entity store and in raw events are rendered as a single deduplicated node in the graph.
 
 When the entity store is enabled, the following resources are created for the active space:
 

solutions/security/advanced-entity-analytics/view-analyze-risk-score-data.md

@@ -169,12 +169,7 @@ On the host details and user details pages, you can access the risk score data:
 
 ### Entity details flyouts [entity-details-flyouts]
 
-In the entity details flyouts, you can access the risk score data in the risk summary section:
-
-:::{image} /solutions/images/security-risk-summary.png
-:alt: Host risk data in the Host risk summary section
-:screenshot:
-:::
+In the entity details flyouts, you can access the risk score data in the [risk score](/solutions/security/advanced-entity-analytics/view-entity-details.md#risk-score) section.
 
 ## Analyze entities over time [historical-entity-analysis]
 ```yaml {applies_to}

solutions/security/advanced-entity-analytics/view-entity-details.md

@@ -30,12 +30,12 @@ The entity details flyout includes the following sections:
 
 * {applies_to}`stack: ga 9.4+` {applies_to}`serverless: ga` Flyout header, which displays key entity information and allows you to assign asset criticality.
 * [Entity summary](#entity-summary), which allows you to generate an AI summary of the entity.
-* [Entity risk summary](#entity-risk-summary), which displays entity risk data and inputs.
+* [Risk score](#risk-score), which displays entity risk data and inputs.
 * [Behavioral anomalies](#behavioral-anomalies), which shows {{ml}} anomalies detected for the entity, mapped to the MITRE ATT&CK framework.
 * [Visualizations](#visualizations), which shows a graph preview of the entity's connections and relationships.
 * [Resolution](#resolution), which allows you to view and manage the entity's resolution group.
 * [Insights](#insights), which displays vulnerabilities or misconfiguration findings for the entity.
-* [Observed data](#observed-data), which displays entity details.
+* [Observed attributes](#observed-attributes), which displays entity details.
 * [Asset Criticality](#asset-criticality), which allows you to view and assign asset criticality.
 
 
@@ -68,29 +68,34 @@ The summary provides a consolidated view of the entity's security posture, helpi
 If you have [AI Assistant](/solutions/security/ai/ai-assistant.md) or [Agent Builder](/explore-analyze/ai-features/elastic-agent-builder.md) set up, you can select **More actions** ({icon}`boxes_vertical`) → **Ask AI Assistant** or **Add to chat** to continue the conversation about the entity in AI Assistant or Agent Builder.
 ::::
 
-### Entity risk summary
+### Risk score [risk-score]
 
 ::::{admonition} Requirements
-The entity risk summary section is only available if the [risk scoring engine is turned on](/solutions/security/advanced-entity-analytics/turn-on-risk-scoring-engine.md).
+This section is only available if the [risk scoring engine is turned on](/solutions/security/advanced-entity-analytics/turn-on-risk-scoring-engine.md).
 ::::
 
-The entity risk summary section contains a risk summary visualization and table.
+::::{note}
+:applies_to: stack: ga 9.0-9.3
+In these versions, this section is called **Host risk summary**, **User risk summary**, or **Service risk summary** depending on the entity type.
+::::
+
+The **Risk score** section contains a risk score visualization and table.
 
-The risk summary visualization shows the entity risk score and risk level. Hover over the visualization to display the **Options** menu. Use this menu to inspect the visualization's queries, add it to a new or existing case, save it to your Visualize Library, or open it in Lens for customization.
+The risk score visualization shows the entity risk score and risk level. Hover over the visualization to display the **Options** menu. Use this menu to inspect the visualization's queries, add it to a new or existing case, save it to your Visualize Library, or open it in Lens for customization.
 
-The risk summary table shows the category, score, and number of risk inputs that determine the entity risk score. Hover over the table to display the **Inspect** button, which allows you to inspect the table's queries.
+The risk score table shows the category, score, and number of risk inputs that determine the entity risk score. Hover over the table to display the **Inspect** button, which allows you to inspect the table's queries.
 
 {applies_to}`stack: ga 9.4+` {applies_to}`serverless: ga` For entities that belong to a [resolution group](/solutions/security/advanced-entity-analytics/entity-resolution.md), the section shows both the individual **Entity risk score** and the **Resolution group risk score** — the aggregated score across all linked entities in the group — each with their own score and inputs breakdown.
 
-To expand the entity risk summary section, click **View risk contributions**. The **Risk contributions** tab displays additional details about the entity's risk inputs.
+Expand the **Risk score** section to access additional details about the entity's risk inputs.
 
 #### Risk score history [risk-score-history]
 ```yaml {applies_to}
 stack: ga 9.5+
 serverless: ga
 ```
 
-Risk scoring recalculates every hour, and every calculation is retained. The expanded entity risk summary opens with a risk score history chart, which shows the entity's score over time so you can identify when its risk posture changed. Dashed reference lines mark the **Low**, **Moderate**, **High**, and **Critical** [risk levels](/solutions/security/advanced-entity-analytics/entity-risk-scoring.md#how-is-risk-score-calculated), which helps you spot when the entity crossed a threshold.
+Risk scoring recalculates every hour, and every calculation is retained. The risk score history chart shows the entity's score over time so you can identify when its risk posture changed. Dashed reference lines mark the **Low**, **Moderate**, **High**, and **Critical** [risk levels](/solutions/security/advanced-entity-analytics/entity-risk-scoring.md#how-is-risk-score-calculated), which helps you spot when the entity crossed a threshold.
 
 To change the time range, use the time filter. Each point on the chart shows the highest risk score recorded for that period.
 
@@ -170,7 +175,12 @@ To add an entity to the group, search by entity name or ID in the **Add entities
 
 The **Insights** section displays [Vulnerabilities Findings](/solutions/security/cloud/findings-page-3.md) for the host or [Misconfiguration Findings](/solutions/security/cloud/findings-page.md) for the user. Click **Vulnerabilities** or **Misconfigurations** to expand the flyout and view this data.
 
-### Observed data
+### Observed attributes
+
+::::{note}
+:applies_to: stack: ga 9.0-9.3
+In these versions, this section is called **Observed data**.
+::::
 
 This section displays details such as the entity ID, when the entity was first and last seen, and the associated IP addresses and operating system.