Modification of default scoring for Alert-->Malware--Suspicious Executable Detected

[DuncanGM]

I am looking for a way to modify the severity score for the alert in category Malware, named Suspicious Executable Detected. By default, this stamps the alert with a MEDIUM severity and therefore creates an Incident with that Severity. I would like to manage the severity level of this alert, so that it is a HIGH severity, as at MEDIUM it does not get the prioritization that I need. 

Is there a way to modify the alert logic to be able to achieve this? 

[jmazzeo · Accepted solution]

Hi @DuncanGM,

Yes, you can modify the Alert Severity by using an Automation Rule.

Going to Incident Response - Response - Automation, you can create a filter rule with the action to set the severity. More details in this document.

If this post answers your question, please mark it as the solution.

[DuncanGM]

Many thanks, I have set that up, just need to test it now. Thank you.