Risk Scoring

Rules Tab

Rules Tab

Where: /dev/org-control/risk-configuration → Rules tab

Scoring rules let you create custom conditions that boost the risk score when specific situations are detected. Think of them as "if this happens, increase the risk."

Rules Table

The Rules tab shows a table listing all scoring rules for your organization. Each row shows:

Column What It Shows
Name Rule name (e.g., "Critical Vulnerabilities Detected")
Status Active or Inactive badge
Module Which module this rule applies to (ASM, BP, or Detection)
Conditions The conditions that trigger the rule (shown as chips)
Impact How much risk the rule adds when triggered (shown as a colored bar)
Priority Execution order (lower = runs first)

How Rules Work

  1. Every time the score is computed, the system checks all active rules
  2. For each rule, it evaluates the conditions against the current data
  3. If all conditions match, the rule's impact is added to the formula as a "Rule Boost"
  4. This boost increases the raw risk input, which pushes the score lower (more risk)

Example

Rule: "Critical Vulnerabilities Detected"

  • Condition: vulnCritical > 5 (more than 5 critical vulnerabilities)
  • Impact: 80
  • Result: When triggered, adds 80 points to the raw input, significantly increasing the risk score

Creating a Rule

  1. Click the "Add Rule" button above the table
  2. A side panel opens with the Rule Builder form
  3. Fill in:
    • Name — Give the rule a descriptive name
    • Module — Select which module it applies to
    • Conditions — Define when the rule should fire (pick a variable, a comparison operator, and a value)
    • Impact — How much risk to add (0–100). Higher = bigger score penalty
    • Weight — Multiplier for the impact (default 1.0)
    • Status — Active or Inactive
  4. Click Save

Managing Rules

  • Edit — Click a rule row to open it in the Rule Builder
  • Duplicate — Create a copy of an existing rule to modify
  • Delete — Remove a rule (this cannot be undone)
  • Reorder — Change the priority/execution order
  • Toggle Active/Inactive — Disable a rule without deleting it

Default Rules

When scoring is first enabled, the system creates a set of default rules for each module. These cover common scenarios like:

  • Critical vulnerability thresholds
  • Active phishing site thresholds
  • Leaked credential detection
  • Low resolution rate warnings

You can edit or disable these default rules at any time.

Tips

  • Start with defaults — The built-in rules cover the most common cases
  • Don't set impact too high — An impact of 80–100 will dramatically drop the score. Use 20–40 for moderate adjustments
  • Use conditions carefully — Rules that trigger too often will keep the score permanently low
  • Check the Rule Boost stat — In the module detail panel, the Formula card shows the total "Rule Boost" value, so you can see how much rules are affecting the score