The Asset Scores page provides a central location from which you can view and investigate information relating to User Scores and Host Scores in your network.
Cortex XDR aggregates data from Workday and Active Directory to create a list of user and host assets located within your network. When alerts and incidents occur, they are associated with a host or user asset and Cortex XDR calculates a score that represents the risk level of each asset. This score can help you to identify high-risk assets in your organization, and detect compromised accounts and malicious activities.
As new alerts are associated with incidents, the User and Host Scores are recalculated. You can view the latest User and Host Scores on the Asset Scores page, or track the Score trend on the User Risk View and Host Risk View.
To investigate your users and hosts, take the following steps.
Select USERS and HOSTS tabs.→ . Use the toggle in the page header to switch between the
The HOSTS tab is available only if the Identity Threat Module add-on is enabled.
Filter and review your assets.
The following table describes the fields in the USERS tab.
The following table describes the fields in the HOSTS tab.
Some User Associated Insights may not appear as part of the User Associated Incidents due to the insight generation mechanism. For example, when an insight related to one of the assets in an incident is generated a few days after the associated incident, the insight may not be associated with the incident.