Learn how to view and investigate User Scores and Host Scores using the Asset Scores page.
The Asset Scores page provides a central location from which you can view and investigate information relating to User Scores and Host Scores in your network.
Note
The Asset Scores page is available if the Identity Threat Module add-on is enabled.
Cortex XDR aggregates Workday and Active Directory data to create a list of user and host assets within your network. When alerts and incidents occur, they are associated with a host or user asset and Cortex XDR calculates a score that represents the risk level of each asset. This score helps to identify high-risk assets in your organization and detect compromised accounts and malicious activities.
To Include System Users in the table, select the Include System Users checkbox: system users are SYSTEM, administrators, NT authority, and others.
Note
As new alerts are associated with incidents, the User and Host Scores are recalculated. You can view the latest User and Host Scores on the Asset Scores page, or track the Score trend on the User Risk View and Host Risk View.
To investigate your users and hosts:
Select → . Use the toggle in the page header to switch between the Users and Hosts tabs.
Filter and review your assets.
To investigate further, right-click on a selected host or user and click Open User Risk View or Host Risk View. For more information, see Investigate a user and Investigate a host.
Note
Some User Associated Insights may not appear as part of the User Associated Incidents due to the insight generation mechanism. For example, when an insight related to one of the assets in an incident is generated a few days after the associated incident, the insight may not be associated with the incident.