Feed Reports with a High Severity Score Generate Alerts with Low Severity

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• With default feed rating, and sensor criticality of 3, a report score of 61 (HIGH THREAT) gives a severity of 41.175 (low threat color)
• With default feed rating, and sensor criticality of 3, a report score of 21 (MEDIUM THREAT) gives a severity of 14.175 (medium trust color).

Environment

• EDR Server: All Versions
• EDR Console: All Versions
• Alert Severity

Cause

• The Green-> Grey-> Red color range of the Security Scores leads to confusing results.
• Report Score labels are not clear on what is a Trust vs a Threat.  

Resolution

Calculation scores will be modified in a Future Release, addressed with CB-30763. 

Additional Information

Workaround issue by modifying the Alert Severity calculation configuration file.

• Following example will disable 'ioc_confidence' by ensuring the ioc_term is always 1.
• With the following configuration, a feed rating of 3, and a sensor criticality of 3, the report severity will be the report score exactly, therefore the report score label (Critical, Major, Minor, etc) will match the alert severity label (Critical, Major, Minor, etc).
• With the following configuration, the alert severity will increase with respect to the report score if the feed score is higher, and vice versa.

{
    "feed_rating": {
        "factors": [[1, 0.125], [0, 0.625]]
    },
    "report_score": {
        "factors": [[1, 1]]
    },
    "sensor_criticality": {
        "factors": [[1, 0.1], [0, 0.7]]
    },
    "ioc_confidence": {
        "factors": [[0, 1]]
    }
}