AnsweredAssumed Answered

IM - Aggregation Rule - Adjust default risk scoring scale

Question asked by Stijn De Wilde on Nov 30, 2017



ESA rules are getting low/medium/high/critical severity mapped to number value of 30/50/70/90.


IM Aggregation rules default risk scoring scale puts low/medium/high/critical as 1-19 / 20-49 / 50-89 /90-100


So for an incident created through an IM Aggregation rule and based on ESA rules and with default risk scoring scale and with default risk rating behaviour which seems to map [im-risk-value == esa-severity-value] , this means the mapping from ESA-rule to IM-rule is like:


ESA-low == IM-medium

ESA-medium == IM-high

ESA-high == IM-high

ESA-critical == IM-critical


I am manually adjusting the default scale for every rule I create to have the two line up, but preferably

* I could modify the built-in default risk scoring scale so I have the "new rule tab" just using what I use in most cases


* I could modify the severity number which gets assigned to ESA low/medium/high/critical



Any way to accomplish that?