> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/configure-incidents-and-alerts/prioritize-incidents-with-starring-and-scoring/incident-scoring.md).

# Incident scoring

{% hint style="info" %}

### Notice

Incident scoring is available in Cortex XDR Pro only.
{% endhint %}

An incident score is a numeric value that indicates the urgency of an incident. Incident scoring can help you to streamline the process of prioritizing and investigating your incidents, and help you to identify the incidents that require immediate attention.

**Types of scoring**

Cortex XDR uses the following scoring methods:

* **Rule-based scoring:** The score is determined by user-defined scoring rules that match the alerts triggered in the incident.

<details>

<summary>Read more...</summary>

You create scoring rules that define scores for alerts with specific attributes or assets. You can base scoring rules on:

* Hostnames
* IP addresses
* Users
* Active Directory, or Azure groups and organization units

  (Requires the Cloud Identity Engine to be configured).

When an alert is triggered, Cortex XDR searches for scoring rules that match the alert. An alert can match multiple rules or sub-rules. If a match is found, Cortex XDR assigns the scores of the matching rules to the alert. If multiple rules match the alert, the alert score is an aggregation of the rule scores. By default, a score is applied only to the first alert in the incident that matches the defined rule and sub-rule.

You can create a rule hierarchy by setting up sub-rules. If an alert matches one or more sub-rules, the sub-rule scores are also aggregated in the alert score. However, a sub-rule score is only applied to an alert if the top-level rule was a match.

To determine the incident score, Cortex XDR calculates the combined alert scores total for all alerts in the incident. You can see a breakdown of the score by clicking on the score in the details pane.

</details>

* **SmartScore:** The score is automatically calculated, based on machine learning.

  SmartScore relies on machine learning, statistical analysis, incident attributes, and cross-customer insights to identify high-risk incidents. When an alert is triggered, Cortex XDR calculates the SmartScore according to the compiled data.
* **Manual scoring:** The score is defined by the user.

**How Cortex XDR assigns the score**

For Cortex XDR to provide effective rule-based scores, you must define accurate scoring rules that are suitable for your environment and workflows. In addition, SmartScore requires sufficient data to calculate and display the score. On first activation, this can take up to 48 hours. If sufficient data is not available, no score is assigned.

When an incident is created, Cortex XDR searches for a match between your scoring rules and the alerts in an incident. If a match is found, a rule based score is assigned. If no match is found and there is sufficient data available, Cortex XDR assigns a SmartScore. If Cortex XDR doesn't have sufficient data to assign a score, you can manually assign a score.

To enable Cortex XDR to automatically assign a score to an incident, you must enable SmartScore and define scoring rules. For more information, see [Set up incident scoring](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/configure-incidents-and-alerts/prioritize-incidents-with-starring-and-scoring/incident-scoring/set-up-incident-scoring.md).

You can see the assigned incident score on the Incidents page, under **Incident Response → Incidents**.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/configure-incidents-and-alerts/prioritize-incidents-with-starring-and-scoring/incident-scoring.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.