> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/incidents-and-alerts/risk-scoring/incident-risk-details.md). # Incident Risk Details Expander provides detailed information about the risks associated with an incident on the **Risk** tab of the incident details pane. The **Risk Details** section includes information about the top three inferred CVEs impacting the risk score and a listing of the **Risk Factors** associated with the alerts in the incident. ![risk-details.png](/files/G4FsERZAm2Jt1ybOwrtW) The following table explains the information about inferred CVEs that is used in calculating the risk score.
CVE InformationDescription
CVE Confidence

Cortex Xpanse categorizes inferred CVE matches as High or Medium confidence based on the version information that is available on the service and from the National Vulnerability Database (NVD).

  • High—Precise version information is available both from the service and from NVD.
  • Medium—Part of the version information from the service matches the NVD entry for the CVE, but the version information from the service has additional characters

For more information about how Expander defines inferred CVEs and levels of confidence around CVEs, see Inferred CVEs

Exploit Maturity
  • Proof of Concept (PoC)—An exploit that may not actually cause harm, but is distributed to demonstrate security weaknesses.
  • Weaponized—An exploit that is explicitly malicious (such as when the exploit is contained within malware) or has been reported as exploited in the wild, or works consistently against all or most targets.
  • None—No known POC or weaponized malware.
Exploited in Wild

A value of Yes indicates one of the following conditions have been met:

  • Named threat actors or known APT groups have been publicly reported to have exploited the vulnerability in the wild
  • CISA has added the vulnerability into Known Exploited Vulnerability (KEV) catalog, the authoritative source of vulnerabilities that have been exploited in the wild
  • Vulnerability is listed in Google Project Zero’s 0day In-The-Wild (ITW)
CVSSThe Common Vulnerability Scoring System (CVSS) score indicates the severity of a security vulnerability with a value between 0 and 10.
EPSS ScoreThe Exploit Prediction Scoring System (EPSS) score indicates the likelihood that a vulnerability will be exploited in the wild. Possible values are between 0 and 100%, and the higher the score, the greater the probability that a vulnerability will be exploited.
Recent Reported Exploit DateThe date when the vulnerability was first known to be exploited-in-the-wild or when it was added to CISA KEV catalog.
For more information about the risk factors that contribute to the risk score for an incident, see Risk Factors. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xpanse/incidents-and-alerts/risk-scoring/incident-risk-details.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.