> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/asset-management/manage-asset-scores.md). # Manage Asset Scores The **Asset Scores** page provides a central location from which you can view and investigate information relating to **User Scores** and **Host Scores** in your network. {% hint style="info" %} ### Note The Asset Scores page is available if the Identity Threat Module add-on is enabled. {% endhint %} Cortex XDR aggregates Workday and Active Directory data to create a list of user and host assets within your network. When alerts and incidents occur, they are associated with a host or user asset and Cortex XDR calculates a score that represents the risk level of each asset. This score helps to identify high-risk assets in your organization and detect compromised accounts and malicious activities. To **Include System Users** in the table, select the **Include System Users** checkbox: system users are SYSTEM, administrators, NT authority, and others. {% hint style="info" %} ### Note As new alerts are associated with incidents, the User and Host Scores are recalculated. You can view the latest User and Host Scores on the Asset Scores page, or track the Score trend on the User Risk View and Host Risk View. {% endhint %} To investigate your users and hosts: 1. Select Assets → **Asset Scores**. Use the toggle in the page header to switch between the **Users** and **Hosts** tabs. 2. Filter and review your assets.
The fields in the Users tab | Field | Description | | ---------- | ------------------------------------------------------------------------------------------------------------------------------ | | Starred | Whether the user is included in the watchlist. | | Score | Represents the Cortex XDR high-risk user score. The score is updated continuously as new alerts are associated with incidents. | | User name | Name of the user as provided by Cortex XDR. | | Full name | Name of the user as provided by Workday or Active Directory. | | Department | Department of the user as provided by Workday or Active Directory. | | Email | Email of the user as provided by Workday or Active Directory. | | Member of | (Derived from AD) The security groups that the user is associated with. | | Featured | Whether the user is flagged as a featured user in the platform. | | Location | Location of the user as provided by Workday or Active Directory. | | Last login | Last date and time the user accessed Cortex XDR. | | Asset role | Asset roles that the user is associated with. |
The fields in the Hosts tab | Field | Description | | ----------------------- | --------------------------------------------------------------- | | Starred | Whether the host is included in the watchlist. | | Hostname | Unique ID of the host. | | Score | Host score. | | IP | IP on which the endpoint is running. | | Has XDR agent | Whether the endpoint has an XDR agent installed. | | Users | Users assigned to the endpoint. | | Agent installation date | Date and time that the XDR agent was installed. | | Last communication | Date and time of last communication. | | Operating system | Operating system with which the endpoint is running. | | Endpoint isolated | Whether the endpoint is isolated. | | Featured | Whether the host is flagged as a featured host in the platform. | | Tags | Endpoint tags applied to the host. | | Group names | User groups that the host is associated with. | | Asset role | Asset roles that the host is associated with. |
3. To investigate further, right-click on a selected host or user and click **Open User Risk View** or **Host Risk View**. For more information, see [Investigate a user](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-artifacts-and-assets/investigate-a-user.md) and [Investigate a host](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-artifacts-and-assets/investigate-a-host.md).

Note

Some User Associated Insights may not appear as part of the User Associated Incidents due to the insight generation mechanism. For example, when an insight related to one of the assets in an incident is generated a few days after the associated incident, the insight may not be associated with the incident.

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/asset-management/manage-asset-scores.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.