Entity Risk Scores

Anomali Agentic SOC Operations calculates a dynamic risk score for each identity and asset based on detection events, peer group membership, and per-entity administrative overrides. This score gives your team a prioritized, context-aware view of which entities need immediate attention.

Understanding the Risk Formula

Each time a detection fires for an entity, the system calculates the raw risk contribution of that detection using the following formula:

Raw Detection Risk = Base Risk (1–5) × Peer Group Weighted Average Modifier × Entity Override.

The three factors in this formula are described in the following sections.

Understanding Base Risk

Each detection rule has a base risk value assigned as an integer from one to five. This value reflects the severity of the signal the rule identifies.

Score	Severity	Description
1	Informational	Low-signal event providing context only, for example, a DNS lookup to a known benign domain.
2	Low	Minor indicator requiring additional context, for example, a failed authentication attempt.
3	Medium	Moderate concern warranting review, for example, Windows admin activity or a UEBA deviation.
4	High	Likely malicious activity, for example, suspected firewall misuse or a privilege escalation attempt.
5	Critical	Confirmed or near-certain attack indicator, for example, confirmed lateral movement or a critical process crash in production.

Using the Peer Group Weighted Average Modifier

Each peer group has a configurable Risk Score Multiplier with a range of 0.1 to 2.0 and a default of 1.0 (neutral). See Peer Groups for information on configuring group multipliers.

When an entity belongs to one or more groups, the system calculates the weighted arithmetic mean of all applicable group multipliers:

Peer Group Weighted Average Modifier = SUM of all group multipliers ÷ number of groups

For example, an entity in four groups with multipliers 1.0, 0.5, 1.3, and 1.1 has a peer group modifier of (1.0 + 0.5 + 1.3 + 1.1) ÷ 4 = 0.975.

When an entity belongs to no groups, the system applies a default modifier of 1.0, leaving the base risk unaffected.

Using Entity Override

The Entity Override is a per-entity multiplier applied as a final adjustment after the peer group modifier. The range is 0.1 to 2.0 and the default is 1.0 (neutral). Administrators use overrides to elevate the risk weight for sensitive entities such as privileged administrators, or to reduce it for known-safe automation accounts. See Entity Risk Score Override for more information.

Understanding Current Risk Score

The Current Risk Score is the value displayed on entity detail pages and in the entity list. It represents the compressed sum of all raw detection risk values from detections that fired within the past 24 hours.

The score is bounded between 0–100. Raw risk values are compressed using a tier model that preserves headroom as detection volume grows — a large number of moderate-severity detections will not saturate the scale and prevent meaningful high-severity signals from registering.

The score is color-coded by risk level:

Risk Level	Score Range	Color
Critical	75–100	Red
High	50–74	Orange-Red
Medium	25–49	Orange/Yellow
Low	0–24	Green

Understanding Score Decay

Each detection contribution expires exactly 24 hours after the detection fires. When a detection expires, its raw risk value is removed from the accumulator and the Current Risk Score is automatically recalculated. This means the score reflects current threat posture rather than an accumulation of historical activity.

If all detections for an entity expire, the Current Risk Score returns to zero. The system processes expiry in a background task that runs approximately every five minutes.

Example

A detection with base risk 3 fires for an identity in four peer groups with multipliers 1.0, 1.1, 1.5, and 0.9. The identity has an entity override of 1.2.

Peer Group Weighted Average Modifier = (1.0 + 1.1 + 1.5 + 0.9) ÷ 4 = 4.5 ÷ 4 = 1.125

Raw Detection Risk = 3 × 1.125 × 1.2 = 4.05

This value of 4.05 is added to the raw risk accumulator for the entity and the Current Risk Score is recomputed from the updated total.

Permissions

Action	Permission Required
View entity risk scores and contributing factors	View Entities
Set or change an entity risk override	Manage Entities
Set or change a peer group Risk Score Multiplier

For details on assigning these permissions to a role, see Managing Roles.