Add the Early Warning flag or Admiralty score as a weighted criterion in a risk rule to prioritize vulnerable items based on threat intelligence data.
Before you begin
The Early Warning for Security Exposure Management integration must be installed and at least one integration run must have completed so that Early Warning fields are available in the risk rule criteria builder.
Role required: [VERIFY]
Procedure
-
Navigate to .
-
In the navigation pane, select Administration.
-
Under the Configurations section, locate Risk calculators tile.
-
Select Review to open the Risk calculator page.
-
Open the risk rule to which to add the criterion, such as Default Risk Rule.
The risk rule form opens showing the existing criteria, condition logic, and the Criteria section where you add new scoring inputs.
-
In the Criteria section, select + New criteria.
A new criteria row expands with fields for Reference table, Table, Field, and Weightage %.
-
In the Reference table field, select Vulnerable Item --> Vulnerability.
-
In the Table field, select National Vulnerability Database Entry.
-
In the Field dropdown, type armis to filter the field list, then select the desired Armis Early Warning field.
Available Armis Early Warning fields include the early warning flag and the admiralty score. To apply a weight based solely on whether early warning is enabled, select the early warning flag field. To incorporate confidence
level, select the admiralty score field and configure it as an additional condition.
-
In the Weightage % field, enter the percentage weight to assign to this criterion.
-
Select Update to save the new criterion.
What to do next
To preview how the updated risk rule scores existing vulnerable items, select Preview in the Criteria section before saving the rule.