Incident scoring

Learn about the different incident scoring methods.

Notice

Incident scoring is available in Cortex XDR Pro only.

An incident score is a numeric value that indicates the urgency of an incident. Incident scoring can help you to streamline the process of prioritizing and investigating your incidents, and help you to identify the incidents that require immediate attention.

Types of scoring

Cortex XDR uses the following scoring methods:

• Rule-based scoring: The score is determined by user-defined scoring rules that match the alerts triggered in the incident.

Read more...

You create scoring rules that define scores for alerts with specific attributes or assets. You can base scoring rules on:

• Hostnames
• IP addresses
• Users
• Active Directory, or Azure groups and organization units

  (Requires the Cloud Identity Engine to be configured).

When an alert is triggered, Cortex XDR searches for scoring rules that match the alert. An alert can match multiple rules or sub-rules. If a match is found, Cortex XDR assigns the scores of the matching rules to the alert. If multiple rules match the alert, the alert score is an aggregation of the rule scores. By default, a score is applied only to the first alert in the incident that matches the defined rule and sub-rule.

You can create a rule hierarchy by setting up sub-rules. If an alert matches one or more sub-rules, the sub-rule scores are also aggregated in the alert score. However, a sub-rule score is only applied to an alert if the top-level rule was a match.

To determine the incident score, Cortex XDR calculates the combined alert scores total for all alerts in the incident. You can see a breakdown of the score by clicking on the score in the details pane.

• SmartScore: The score is automatically calculated, based on machine learning.

  SmartScore relies on machine learning, statistical analysis, incident attributes, and cross-customer insights to identify high-risk incidents. When an alert is triggered, Cortex XDR calculates the SmartScore according to the compiled data.
• Manual scoring: The score is defined by the user.

How Cortex XDR assigns the score

For Cortex XDR to provide effective rule-based scores, you must define accurate scoring rules that are suitable for your environment and workflows. In addition, SmartScore requires sufficient data to calculate and display the score. On first activation, this can take up to 48 hours. If sufficient data is not available, no score is assigned.

When an incident is created, Cortex XDR searches for a match between your scoring rules and the alerts in an incident. If a match is found, a rule based score is assigned. If no match is found and there is sufficient data available, Cortex XDR assigns a SmartScore. If Cortex XDR doesn't have sufficient data to assign a score, you can manually assign a score.

To enable Cortex XDR to automatically assign a score to an incident, you must enable SmartScore and define scoring rules. For more information, see Set up incident scoring.

You can see the assigned incident score on the Incidents page, under Incident Response → Incidents.