Incident Scoring Rules Overview

Use incident scoring rules to score the risk of an incident by verifying that the indicators of compromise are already blocked from execution or mitigated by other events that contributed toward this incident. Rules comprise the following elements:

• Condition—The matching condition available for any field type are mitigated by another event and not mitigated by another event.

• Action—An action is a response to an incident. You can raise or lower the severity, set the severity value, or skip the remaining rules.

To access this page, select Juniper Security Director Cloud > Shared Services > Insights > <Rules> Incident Scoring Rules.