Incident scoring rules

[Antony_Chan]

Dear LIVEcommunity,

Our environment had the SMART score enabled and now I'm working on incident scoring rules to make the VIP username and/or their devices stand out when alert generated matched their username/hostname.

I had their information flagged as "featured user/host", Am wondering what the recommended scoring structure would be. Kindly share your idea/practice for reference purposes.

My current idea is to score the first alert (any category, except restriction) with 100, ignore subsequent alert that is identical to the first one.

Cortex XDR 

Thank you.

[aspatil]

Hello Anthony,

It's completely based on the individual organization policy, how would they want as everyone has their different requirements.