How the Forensic Score is Calculated
For each Workload, we compute a Forensics Score. A Workload’s Forensics Score is derived from the Forensic Events observed on that Workload based on the profiles that are enabled for this scope. A score of 100 means that no Forensic Events were observed via configured rules in enabled profiles, and a score of 0 means that there is a Forensic Event detected that requires immediate action. The Forensics Score for a Scope is the average Workload score within that Scope. Forensics Score for a given hour is a minimum of all scores within that hour.
-
A Forensic Event with the severity REQUIRES IMMEDIATE ACTION reduces the Score for the entire Scope to zero.
-
A Forensic Event with the severity CRITICAL reduces workload’s score with the weight of 10.
-
A Forensic Event with the severity HIGH reduces workload’s score with the weight of 5.
-
A Forensic Event with the severity MEDIUM reduces workload’s score with the weight of 3.
-
A Forensic Event with the severity LOW doesn’t contribute to the Forensics Score. This is recommended for new rules where the quality of the signal is still being tuned and is likely to be noisy.
For example, a workload has 3 forensic events that match 2 rules with CRITICAL severity, 1 rule with HIGH severity, 1 rule with LOW, respectively. The forensic score for that workload is: 100 - 1 * 10 - 1 * 5 - 1 * 0 = 85.
The Forensics Scores are N/A for workloads in which the Forensics feature is not enabled.