Set up case scoring ↗

Set up Cortex XSIAM case scoring to prioritize cases and issues. Enable SmartScore and configure user-defined scoring rules that match your investigation criteria.

Enable Cortex XSIAM SmartScore

Enable SmartScore before you configure Cortex XSIAM case scoring rules.

  1. Select Settings → Configurations → Cortex XSIAM- Analytics and click Enable.
  2. Select Cases & Issues → Case Configuration → Case Scoring and enable SmartScore.

On the first activation, it can take up to 48 hours for SmartScore to calculate and display the score.

Enabling SmartScore subsequently impacts the User Score.

Create case and issue scoring rules

  1. Select Cases & Issues → Case Configuration → Case Scoring → Scoring Rules and enable User Scoring Rules.

    The Scoring Rules table displays the user-defined rules and sub-rules.

  2. Click Add Scoring Rule.
  3. In the Create New Scoring Rule dialog, define the rule criteria:
    • Score = 30
    • Base Rule = Root

    • Filters:

      Issue Source=XDR BIOC AND Severity=Critical

  4. Click Create.

    You are automatically redirected to the Scoring Rules table.

  5. In the Scoring Rules table, click Save to save your scoring rule.

    For scoped users, a small lock icon indicates that you don't have permissions to edit a rule.

Manage existing case scoring rules

In the Scoring Rules table, take the following actions to review your rules and sub-rules:

  • Use the arrows to rearrange rule priorities. Click Save after any changes.
  • Select one or more rules and right-click to see the available actions.

Scope-Based Access Control for case scoring

Case scoring supports Scope-Based Access Control (SBAC). If you're a scoped user, a small lock icon indicates that you cannot edit a rule. The following parameters apply when you edit a scoring rule:

  • If Scope-Based Access Control (SBAC) is enabled and Endpoint Scoping Mode is set to restrictive mode, you can edit a rule if you are scoped to all tags in the rule.
  • If Scope-Based Access Control (SBAC) is enabled and Endpoint Scoping Mode is set to permissive mode, you can edit a rule if you are scoped to at least one tag listed in the rule.
  • To change the order of a rule, you must have permissions to the other rules of which you want to change the order.
  • If a rule was added when set to restrictive mode, and then changed to permissive (or vice versa), you will only have view permissions.