> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-verdict.md). # Indicator Verdict An indicator’s verdict is assigned according to the verdict returned by the source with the highest reliability. In cases where multiple sources with the same reliability score return a different verdict for the indicator, the worst verdict is taken. **Indicator verdicts** Indicators are assigned a verdict on a scale of 0 to 3. | Score | Verdict | Color | | ----- | ---------- | ------ | | 0 | Unknown | Gray | | 1 | Benign | Green | | 2 | Suspicious | Orange | | 3 | Malicious | Red | {% hint style="info" %} ### Note You can change the benign verdict by editing the indicator. If you have manually changed the indicator’s verdict and want to recalculate it according to enrichment integrations, click **Calculate** when editing the indicator. {% endhint %} **Source reliability** The reliability of an intelligence-data source influences the verdict of an indicator and the values for indicator fields when merging indicators. Indicator fields are merged according to the source reliability hierarchy. This means that when there are two different values for a single indicator field, the field will be populated with the value provided by the source with the highest reliability score. Source reliability hierarchy also determines which custom indicator field mapping is used. The system uses the custom indicator field mapping from the integration instance with the highest source reliability score. To prioritize a specific mapping, ensure its integration instance has the highest source reliability score. In rare cases, two sources with the same reliability score might return different values for the same indicator field. In these cases, the field is populated with the most recently provided source, unless the field is verdict. If two sources have the same reliability score and return different values for the verdict field, the worse verdict is used. For the field types Tags and Multi-select, all values are appended, nothing is overridden. | Source | Reliability Score | Notes | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- | | Manual | A+++ | A user manually updates the verdict of an indicator. | | [Reputation script](/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types/reputation-scripts.md) | A++ | A script with the **reputation** tag, which calculates the verdict of an indicator. | | Third-party enrichment | A+ | An integration or service that evaluates the verdict of an indicator. For example, the urlscan.io integration evaluates the verdict of a URL. | | Feed | A: Completely reliable | The feed reliability is applied at the integration instance level. | | Feed | B: Usually reliable | The feed reliability is applied at the integration instance level. | | Feed | C: Fairly reliable | The feed reliability is applied at the integration instance level. | | Feed | D: Not usually reliable | The feed reliability is applied at the integration instance level. | | Feed | E: Unreliable | The feed reliability is applied at the integration instance level. | | Feed | F: Reliability cannot be judged | The feed reliability is applied at the integration instance level. | **Example 1** In this example, two third-party integrations, VirusTotal and AlienVault, return a different verdict for the same indicator. The indicator’s verdict will be Malicious because VirusTotal’s reliability score is higher than AlienVault. | Integration | Reliability | Verdict | Final Verdict | | ----------- | ----------------------- | --------- | ------------- | | VirusTotal | C - Fairly reliable | Malicious | Malicious | | AlienVault | D- Not usually reliable | Benign | Malicious | **Example 2** In this example, two sources with the same verdict score return a different verdict for the same indicator. The indicator’s verdict will be Malicious because when two sources have the same reliability, the worse verdict applies. | Integration | Reliability | Verdict | Final Verdict | | ----------- | -------------------- | --------- | ------------- | | TAXII Feed | B - Usually reliable | Malicious | Malicious | | CSV Feed | B - Usually reliable | Benign | Malicious | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-verdict.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.