Observable scoring | Decay#

Observable risk scores are intended to decay over time to represent the threat they pose diminishing after initial discovery. The decay period is the number of days after the last time the Observables Risk score was updated it takes to drop one Risk score level. Decay can be defined separately for each Observable type.

If you set the decay period to 0, the Risk score for that Observable type will not decay.

Setting decay periods#

  1. From the left sidebar, select Observable risk score.

  2. Select Settings in the top-right corner.

  3. Check the boxes of the Observable types for which you want to set the same decay period.

  4. Select Pencil Edit decay.

  5. Enter a number of days and select Apply.

  6. Repeat steps 3 through 5 until all Observable types are assigned the decay period you’d like them to have.