Hi,
ESA rules are getting low/medium/high/critical severity mapped to number value of 30/50/70/90.
IM Aggregation rules default risk scoring scale puts low/medium/high/critical as 1-19 / 20-49 / 50-89 /90-100
So for an incident created through an IM Aggregation rule and based on ESA rules and with default risk scoring scale and with default risk rating behaviour which seems to map [im-risk-value == esa-severity-value] , this means the mapping from ESA-rule to IM-rule is like:
ESA-low == IM-medium
ESA-medium == IM-high
ESA-high == IM-high
ESA-critical == IM-critical
I am manually adjusting the default scale for every rule I create to have the two line up, but preferably
* I could modify the built-in default risk scoring scale so I have the "new rule tab" just using what I use in most cases
or
* I could modify the severity number which gets assigned to ESA low/medium/high/critical
Any way to accomplish that?
thanks,
Stijn
