This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
Detection Scoring Guide
This document describes the scoring strategy used for Splunk Security Content detections in ESCU v6.x+. Scores drive risk-based alerting (RBA) and replace the legacy impact × confidence / 100 formula.
Each detection carries a risk score that reflects both how reliably it fires (confidence) and how dangerous the behavior it catches is (detection type). Scores are set by the detection author at creation time and should be revisited as the analytic matures.
The table below is just a short guideline that STRT uses to determine the initial score for a new detection. Authors pick the row that best describes the detection's type and behavioral specificity, then use the score range as a starting point — tuning up or down based on known false positive rates and strength of evidence.
| Score Range | Confidence Level | Detection Type | Meaning |
|---|---|---|---|
| 0 – 9 | Very Low | Hunting → Anomaly | Hunting queries promoted to anomaly to participate in correlation searches |
| 10 – 19 | Low | Anomaly | Weak or noisy signal with minimal behavioral context; benign activity is common |
| 20 – 39 | Medium | Anomaly | Unusual behavior pattern detected, but malicious intent is unclear and ATT&CK mapping may be absent |
| 40 – 49 | Medium-High | Anomaly | Suspicious anomaly with no direct ATT&CK mapping; warrants investigation |
| 50 – 69 | High | TTP | Behavior clearly maps to a known ATT&CK technique; likely malicious |
| 70 – 89 | Very High | TTP | Multiple related TTPs or strong contextual evidence of an active attack |
| 90 – 100 | Confirmed / Critical | TTP | Confirmed malicious or IOC-specific (hash, C2 name, unique artifact) |
Using the table above, STRT determines the Default initial scores (the STRT baseline): for each detection based on its type::
- New Anomaly detections →
20 - New TTP detections →
50
Guidance for Detection Authors
- Start from the baseline. New anomaly detections begin at
20; new TTP detections begin at50. - Revisit after deployment. After observing the false-positive rate in production, adjust the score accordingly. A detection that fires almost exclusively on real threats can be moved higher; one that generates noise should move lower.
Where Scores Appear in a Detection YAML
intermediate_findings:
entities:
- field: dest
type: system
score: 20 # risk score for this detection
message: a non azure cli process $ProcessName$ accessing $ObjectName$
The score field under intermediate_findings: or finding: entities feeds the RBA risk index. Set it according to the table above.
for more information related to Splunk Findings and Intermediate Findings