> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/set-up-case-scoring.md).

# Set up case scoring

To set up case scoring, you need to enable SmartScore and enable and define scoring rules.

### Enable SmartScore

To set up case scoring, you need to enable SmartScore and enable and define scoring rules.

1. Select Settings → Configurations → **Cortex XSIAM- Analytics** and click **Enable**.
2. Select Cases & Issues → Case Configuration → **Case Scoring** and enable **SmartScore**.

{% hint style="info" %}

### Note

On the first activation, it can take up to 48 hours for SmartScore to calculate and display the score.

Enabling SmartScore subsequently impacts the User Score.
{% endhint %}

### Enable and define scoring rules

1. Select Cases & Issues → Case Configuration → Case Scoring → Scoring Rules and enable User Scoring Rules.

   The Scoring Rules table displays the user-defined rules and sub-rules.
2. Click Add Scoring Rule.
3. In the Create New Scoring Rule dialog, define the rule criteria:

   1. Under Rule Name, enter a unique name for your rule.
   2. Under Score, define the score that Cortex XSIAM should apply to issues that matching the rule criteria.
   3. Under Base Rule, select whether to create a top-level rule (labeled Root) or a sub-rule (labeled *Rule Name (ID:#)*). By default, rules are defined at the root level.
   4. Select or deselect Apply score only to first issue of case.

      By selecting this option you choose to apply the score only to the first issue that matches the defined rule. Subsequent issues of the same case will not receive a score from this rule. By default, a score is applied only to the first issue that matches the defined rule and sub-rule.
   5. In the issue table, use the filters to define the attributes you want to include in the rule match criteria. For example, you can select issues with High severity, issues by category, or issues associated with certain assets or asset providers.

      Right-click an issue field to add it as match criteria.

   Example: With this rule, Cortex XSIAM assigns a score of 30 to any XDR BIOC issues with a severity level of Critical:

   * Score = 30
   * Base Rule = Root
   * Filters:

     `Issue Source=XDR BIOC AND Severity=Critical`

   <br>
4. Click Create.

   You are automatically redirected to the Scoring Rules table.
5. In the Scoring Rules table, click Save to save your scoring rule.

   For scoped users, a small lock icon indicates that you don't have permissions to edit a rule.

### Revise existing scoring rules

In the Scoring Rules table, take the following actions to review your rules and sub-rules:

* Use the arrows to rearrange rule priorities. Make sure to click Save after any changes.
* Select one or more rules and right-click to see the available actions.

### Scope-Based Access Control Considerations

Case Scoring supports Scope-Based Access Control (SBAC). If you're a scoped user, a small lock icon indicates that you don't have permissions to edit a rule. The following parameters are considered when editing a scoring rule:

* If Scope-Based Access Control (SBAC) is enabled and Endpoint Scoping Mode is set to restrictive mode, you can edit a rule if you are scoped to all tags in the rule.
* If Scope-Based Access Control (SBAC) is enabled and Endpoint Scoping Mode is set to permissive mode, you can edit a rule if you are scoped to at least one tag listed in the rule.
* To change the order of a rule, you must have permissions to the other rules of which you want to change the order.
* If a rule was added when set to restrictive mode, and then changed to permissive (or vice versa), you will only have view permissions.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/set-up-case-scoring.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.