Manage Risk Scores ↗

An risk score is a dynamic risk metric, typically ranging from 10 to 100 though it can go higher with custom modifiers, assigned to users and hosts. It acts as an aggregate indicator of how much security risk a specific identity or machine currently represents.

Note

Customers with the Identity Threat Module add-on have access to risk scores.

Cortex XSIAM aggregates Workday and Active Directory data to create a list of user and host assets within your network. A user or host risk card is generated only after an alert associated with that specific entity is triggered. Cortex XSIAM calculates the score by summing the scores of the cases and alerts that the specific asset is implicated in.

For users, the underlying data driving these scores heavily relies on authentication logs, such as VPNs and Single Sign-On events. Cortex XSIAM aggregates this risk by the exact hostname or username. If multiple alerts map to the exact same name, the score aggregates under a single Risk View.

Risk scores act as an important input for the broader alert ecosystem. The Cortex SmartScore algorithm factors in the Risk Score, meaning a critical alert on an asset with a low risk score might be given a lower overall SmartScore, while minor alerts on highly critical assets might be elevated.

You can view the latest scores by navigating to Inventory → Assets → Risk Scores. This page provides a birds-eye view of your riskiest entities. Use the toggle in the page header to switch between the Users and Hosts tabs. Access to the Hosts tab and the associated Risk Management dashboard requires the Identity Threat Module add-on and Analytics to be enabled.

To include system users in the table, such as administrators or NT authority, select the Include System Users checkbox. From the table, you can filter and review your assets. To investigate further, right-click on a selected host or user and click Open User Risk View or Open Host Risk View to track the score trend over time.

Users tab fields

Field	Description
Starred	Whether the user is included in the watchlist.
Score	Represents the Cortex XSIAM high-risk user score. The score is updated continuously as new alerts are associated with incidents.
User name	Name of the user as provided by Cortex XSIAM.
Full name	Name of the user as provided by Workday or Active Directory.
Department	Department of the user as provided by Workday or Active Directory.
Email	Email of the user as provided by Workday or Active Directory.
Member of	(Derived from AD) The security groups that the user is associated with.
Featured	Whether the user is flagged as a featured user in the platform.
Location	Location of the user as provided by Workday or Active Directory.
Last login	Last date and time the user accessed Cortex XSIAM.
Asset role	Asset roles that the user is associated with.

Hosts tab fields

Field	Description
Starred	Whether the host is included in the watchlist.
Hostname	Unique ID of the host.
Score	Host score.
IP	IP on which the endpoint is running.
Has XDR agent	Whether the endpoint has an XDR agent installed.
Users	Users assigned to the endpoint.
Agent installation date	Date and time that the XDR agent was installed.
Last communication	Date and time of last communication.
Operating system	Operating system with which the endpoint is running.
Endpoint isolated	Whether the endpoint is isolated.
Featured	Whether the host is flagged as a featured host in the platform.
Tags	Endpoint tags applied to the host.
Group names	User groups that the host is associated with.
Asset role	Asset roles that the host is associated with.

Note

Some User Associated Insights may not appear as part of the User Associated Incidents due to the insight generation mechanism. For example, when an insight related to one of the assets in an incident is generated a few days after the associated incident, the insight may not be associated with the incident.