> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/manage-asset-scores.md).
# Manage Risk Scores
An risk score is a dynamic risk metric, typically ranging from 10 to 100 though it can go higher with custom modifiers, assigned to users and hosts. It acts as an aggregate indicator of how much security risk a specific identity or machine currently represents.
{% hint style="info" %}
### Note
Customers with the Identity Threat Module add-on have access to asset scores.
{% endhint %}
Cortex XDR aggregates Workday and Active Directory data to create a list of user and host assets within your network. A user or host risk card is generated only after an alert associated with that specific entity is triggered. Cortex XDR calculates the score by summing the scores of the cases and alerts that the specific asset is implicated in.
For users, the underlying data driving these scores heavily relies on authentication logs, such as VPNs and Single Sign-On events. Cortex XDR aggregates this risk by the exact hostname or username. If multiple alerts map to the exact same name, the score aggregates under a single Risk View.
Risk scores act as an important input for the broader alert ecosystem. The Cortex SmartScore algorithm factors in the Risk Score, meaning a critical alert on an asset with a low asset score might be given a lower overall SmartScore, while minor alerts on highly critical assets might be elevated.
You can view the latest scores by navigating to **Inventory** → **Assets** → **Risk Scores**. This page provides a birds-eye view of your riskiest entities. Use the toggle in the page header to switch between the **Users** and **Hosts** tabs. Access to the **Hosts** tab and the associated **Risk Management** dashboard requires the Identity Threat Module add-on and Analytics to be enabled.
To include system users in the table, such as administrators or NT authority, select the **Include System Users** checkbox. From the table, you can filter and review your assets. To investigate further, right-click on a selected host or user and click **Open User Risk View** or **Open Host Risk View** to track the score trend over time.
Users tab fields
| Field | Description |
| ---------- | ------------------------------------------------------------------------------------------------------------------------------ |
| Starred | Whether the user is included in the watchlist. |
| Score | Represents the Cortex XDR high-risk user score. The score is updated continuously as new alerts are associated with incidents. |
| User name | Name of the user as provided by Cortex XDR. |
| Full name | Name of the user as provided by Workday or Active Directory. |
| Department | Department of the user as provided by Workday or Active Directory. |
| Email | Email of the user as provided by Workday or Active Directory. |
| Member of | (Derived from AD) The security groups that the user is associated with. |
| Featured | Whether the user is flagged as a featured user in the platform. |
| Location | Location of the user as provided by Workday or Active Directory. |
| Last login | Last date and time the user accessed Cortex XDR. |
| Asset role | Asset roles that the user is associated with. |
Hosts tab fields
| Field | Description |
| ----------------------- | --------------------------------------------------------------- |
| Starred | Whether the host is included in the watchlist. |
| Hostname | Unique ID of the host. |
| Score | Host score. |
| IP | IP on which the endpoint is running. |
| Has XDR agent | Whether the endpoint has an XDR agent installed. |
| Users | Users assigned to the endpoint. |
| Agent installation date | Date and time that the XDR agent was installed. |
| Last communication | Date and time of last communication. |
| Operating system | Operating system with which the endpoint is running. |
| Endpoint isolated | Whether the endpoint is isolated. |
| Featured | Whether the host is flagged as a featured host in the platform. |
| Tags | Endpoint tags applied to the host. |
| Group names | User groups that the host is associated with. |
| Asset role | Asset roles that the host is associated with. |
{% hint style="info" %}
### Note
Some **User Associated Insights** may not appear as part of the **User Associated Incidents** due to the insight generation mechanism. For example, when an insight related to one of the assets in an incident is generated a few days after the associated incident, the insight may not be associated with the incident.
{% endhint %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/manage-asset-scores.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.