Calculate Severity - Cortex XDR Risky Assets

Calculates a severity for the incident based on the involvement of risky users or risky hosts in the incident, as determined by the Cortex XDR ITDR module.

Pack

CortexXDR

Tasks

14

Inputs

• XDRRiskyUsers — An object of risky users and their corresponding scores, as outputted by the "xdr-list-risky-users" command.
• XDRRiskyHosts — An object of risky hosts and their corresponding scores, as outputted by the "xdr-list-risky-hosts" command.

Outputs

• Severities.XDRUserSeverity — The severity evaluated by the highest risk level associated with the Cortex XDR user. Can be Low, Medium or High.
• Severities.XDRHostSeverity — The severity evaluated by the highest risk level associated with the Cortex XDR host. Can be Low, Medium or High.