diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/constants.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/constants.tsx
index 030005b45ac62..a51763ba61137 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/constants.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/constants.tsx
@@ -21,4 +21,5 @@ export const SIGNAL_STATUS_FIELD_NAME = 'kibana.alert.workflow_status';
export const AGENT_STATUS_FIELD_NAME = 'agent.status';
export const QUARANTINED_PATH_FIELD_NAME = 'quarantined.path';
export const REASON_FIELD_NAME = 'kibana.alert.reason';
+export const RISK_SCORE = 'kibana.alert.risk_score';
export const EVENT_SUMMARY_FIELD_NAME = 'eventSummary';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/formatted_field.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/formatted_field.tsx
index 299bb736ec4f2..423c40effa996 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/formatted_field.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/formatted_field.tsx
@@ -39,12 +39,18 @@ import {
IP_FIELD_TYPE,
MESSAGE_FIELD_NAME,
REFERENCE_URL_FIELD_NAME,
+ RISK_SCORE,
RULE_REFERENCE_FIELD_NAME,
SIGNAL_RULE_NAME_FIELD_NAME,
SIGNAL_STATUS_FIELD_NAME,
USER_NAME_FIELD_NAME,
} from './constants';
-import { renderEventModule, RenderRuleName, renderUrl } from './formatted_field_helpers';
+import {
+ renderEventModule,
+ RenderRiskScore,
+ RenderRuleName,
+ renderUrl,
+} from './formatted_field_helpers';
import { RuleStatus } from './rule_status';
import { HostName } from './host_name';
import { UserName } from './user_name';
@@ -239,6 +245,8 @@ const FormattedFieldValueComponent: React.FC<{
value={value}
/>
);
+ } else if (fieldName === RISK_SCORE) {
+ return value ? : null;
} else if (fieldName === EVENT_MODULE_FIELD_NAME) {
return renderEventModule({
contextId,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/formatted_field_helpers.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/formatted_field_helpers.tsx
index d41c0238ce592..1a1f8f22500cf 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/formatted_field_helpers.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/formatted_field_helpers.tsx
@@ -12,6 +12,7 @@ import type { SyntheticEvent } from 'react';
import React, { useCallback, useMemo, useContext } from 'react';
import styled from 'styled-components';
import { useExpandableFlyoutApi } from '@kbn/expandable-flyout';
+import { formatRiskScore } from '../../../../../entity_analytics/common';
import { DefaultDraggable } from '../../../../../common/components/draggables';
import { getEmptyTagValue } from '../../../../../common/components/empty_value';
import { getRuleDetailsUrl } from '../../../../../common/components/link_to/redirect_to_detection_engine';
@@ -382,3 +383,16 @@ export const renderUrl = ({
getEmptyTagValue()
);
};
+
+interface RenderRiskScoreProps {
+ value: number | string;
+}
+
+export const RenderRiskScore: React.FC = ({ value }) => {
+ return (
+
+ {/* Usually is a string */}
+ {formatRiskScore(Number(value))}
+
+ );
+};