Risk scoring

A rule's severity says what kind of event matched. It cannot say whether the machine matters, whether the same thing has already fired forty times, or whether it happened at three in the morning. The risk score adds that context, and the console shows its working on every alert.

The four factors#

Every alert is scored from four factors. Each factor carries a weight, the weights add up to 100%, and the result is a score from 0 to 100.

The weights are yours to change. See Tuning the weights.

Severity#

Based on the level the detection rule assigns. The scale is deliberately not linear: anything the rules rate medium or worse always outweighs anything they rate low, so severity genuinely sorts the queue.

Asset criticality#

The level you assign the machine in Settings: Low, Medium, High or Critical. A machine you have not classified counts as Medium.

Classify your important machines first. It is the single change that most improves the queue.

Deduplication#

For most rules, repetition is a sign of routine activity, not of risk, so heavy repetition lowers an alert's priority and one noisy rule cannot flood the queue.

For authentication failures and scanning the logic is reversed, because there repetition is the attack: a burst of failed sign-ins is a brute force, not a series of unrelated events. For these rules, repetition raises the priority.

Time context#

Neutral unless the alert falls inside a schedule you have defined, in which case the schedule's level applies. Use it to weight activity differently inside and outside working hours.

Risk bands#

The score is also shown as a band, using the same four words as severity:

The same rule therefore lands in a different band on a domain controller than on a test laptop. That difference is the point of the score.

Trust rules#

A trust rule marks activity you know to be legitimate and lowers its score, by an amount set by its trust level. Fully trusted sets the score to zero.

Seeing the calculation#

Open any alert on the Alert Pipeline, or the Context tab of an alert, to see its four factors and how much each contributed to its score.

Tuning the weights#

Open Settings, then Risk Weights. Four sliders set the weights; each shows how far it has moved from the saved value. With Lock total on, raising one weight lowers the others so the total stays at 100%. Save applies the change at once, Discard abandons it, and Reset returns to the defaults.

Changing the weights requires the Administrator role.