In Helix Enterprise, the risk score indicates the severity of a threat. The higher the risk score, the more severe the threat. Separate risk scores are calculated for alerts, correlations, and assets.
Alert risk score
An alert risk score is calculated from the severity and confidence of an alert.
Correlation risk score
A correlated threat is a collection of multiple alerts. The correlation risk score is calculated by multiplying the sum of the individual alert risk scores by the unique number of rules, and then dividing by the total number of alerts in the correlation group.
If a VIP asset is affected by a threat, the risk score is automatically set to 100, irrespective of the risk score derived from the formula. If you tag or untag an asset as a VIP asset, the risk score is automatically recalculated.
Asset risk score
You can view the asset risk score on the Assets page. The table displays VIP assets first, sorted by risk score, followed by all other assets sorted by risk score. The asset risk score is calculated by multiplying the sum of the risk scores of all open and reopened alerts on the asset by the unique number of rules across all open and reopened alerts on the asset, and then dividing by the total number of open and reopened alerts on the asset.
The following table displays the risk score and the corresponding severity of the threat.
Risk score | Severity |
|---|---|
0—59 | Low |
60—79 | Medium |
80—99 | High |
≥100 | Critical |