Configuring and Calculating Risk Score
The Swimlane VRM Enrichment connector calculates the Turbine Risk Score from Risk Score Parameters on the VRM Client Configuration asset.
Edit Risk Score Parameters
- Open Orchestration > Assets.
- Open VRM Client Configuration.
- Edit the Risk Score Parameters (risk_score_parameters) JSON string.
- Save the asset.
- The next staged enrichment run and the next Reprocess Finding run use the updated weights.
Do not edit scoring objects inside VRM - Calculate Turbine Risk Score for the 26.3.0 bulk path. That component is not the configuration source for staged enrichment.
Default Scoring Objects
The 26.3.0 package includes these objects. Weights are relative. Boolean objects use max_value 1.
Name | Weight | Max | What It Measures |
|---|---|---|---|
CVSS Base Score | 30 | 10 | Intrinsic vulnerability severity. |
EPSS Exploitation Probability | 25 | 1 | Probability of exploitation in the next 30 days. |
Asset Criticality | 15 | 10 | Business criticality of the affected asset. |
CVSS Temporal/Threat Score | 10 | 10 | Time-dependent severity factors. |
Asset Zone Criticality | 5 | 10 | Network zone criticality of the affected asset. |
CISA KEV Status | 5 | 1 | Whether the vulnerability is in the CISA Known Exploited Vulnerabilities catalog. |
Weaponized Exploit Available | 5 | 1 | Whether a weaponized exploit has been found. |
Public Exploit Available | 3 | 1 | Whether public exploit code is available. |
Reported Exploited in the Wild | 2 | 1 | Whether exploitation has been reported. |
Each object includes a key that maps to a field on the vulnerability finding, a type of numeric or boolean, and, for booleans, a value_map.
Change a Weight
- Locate the scoring object in Risk Score Parameters.
- Set weight to an integer of 0 or greater.
- Save the asset.
Remove a Scoring Object
- Delete the object from the JSON.
- Save the asset.
Add a Scoring Object
- Add a new object with a unique name.
- Set name to the display name.
- Set key to the finding field name.
- Set weight to an integer of 0 or greater.
- Set max_value to the highest value the field can have. Use 1 for booleans.
- Set type to numeric or boolean.
- For a boolean, add a value_map that assigns 1 and 0.
- Save the asset.
The finding record still visualizes the Turbine Risk Score components after enrichment.
Next Steps
- Review Installing and Configuring for the other VRM Client Configuration parameters, including Grouping Parameters.
- Review Vulnerability Findings for how the score appears on a finding.