> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/incidents-and-alerts/risk-scoring.md).

# Risk Scoring

In Cortex Xpanse Expander you can prioritize incidents and quantify your organization's risk trends using risk scoring. By default, Expander assigns a base risk score (called the Xpanse Risk Score) to every incident. Expander calculates this risk score using the threat and exploit intelligence relevant to the CVEs on the related service or website (based on active classifications or web technologies) for an incident. When the alerts change (for example, if an alert is resolved or a new alert is created) or if the underlying risks change, Expander recalculates and updates the risk score .

The Xpanse Risk Score calculation is based on a number of factors, including the following:

* The EPSS and CVSS scores of the inferred CVEs on the related service or website
* Whether the inferred CVEs were weaponized or exploited in the wild
* How recently the inferred CVEs were exploited
* The presence of these [Risk Factors](/cortex-xpanse/incidents-and-alerts/risk-scoring/risk-factors.md)
* Attack surface test results—"Confirmed Vulnerable" attack surface test results associated with an incident increase the risk score. Negative attack surface test results on one or more alerts associated with an incident are removed from the calculation of an incident's risk.

In addition to the Xpanse Risk Score that is assigned to each incident, you can also create custom risk-scoring rules that adjust the Xpanse Risk Score or manually assign a risk score. These flexible approaches to risk scoring enable you to prioritize incidents based on the specific requirements of your organization. See [Customize Risk Scoring](/cortex-xpanse/customize-risk-scoring.md) for instructions on how to enable or disable Xpanse Risk Scoring, how to create or edit custom User Scoring Rules, or how to manually assign a risk score.

The risk score is displayed on the Incidents page in the Incidents list and in the incident details pane. Click on the score to open the **Manage Risk Score** dialog box, where you can view the **User Scoring Rules** for this incident or set the risk score manually.

![risk-score.png](/files/aica2K6RXpCT5ymVcUUG)

By default, the incident list is sorted by risk score, and you can also filter incidents on risk score.

## Risk score color coding

The color of the risk score indicates the risk score range to help you identify incident risk at a glance.

| Color    | Risk Score Range |
| -------- | ---------------- |
| Dark red | More than 650    |
| Red      | 501 to 650       |
| Orange   | 251 to 500       |
| Blue     | 1 to 250         |
| Gray     | 0                |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xpanse/incidents-and-alerts/risk-scoring.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.