cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
395
Views
4
Helpful
1
Replies

MARS Incident Severity

cashqoo
Level 1
Level 1

Hi,

How does MARS define or calculate Incident Severity?

-Low (green)

-medium (yellow)

-high (red)

is it the same as IPS Risk rating?

Thanks in advance.

cash

1 Reply 1

mogli
Level 1
Level 1

Hi,

it seems that the severity of a particular incident is derived form the severities of the fired events that lead to the incident (due to matching in a rule).

the pre-defined events have already pre-defined severities (Management -> Event Management). They can not be edited.

If you are defining Custom Events you can set the severity to the level you like.

hope this helps,

br

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: