Threat Intelligence
How does Kondukto calculate the risk rating?
When CISA KEV + EPSS integration is enabled, Kondukto can automatically adjust the severity of vulnerabilities based on the risk rating that is calculated by looking at the EPSS probability and the percentile. This configuration is made when activating the CISA KEV + EPSS integration in the first place.
EPSS probability and percentile are updated daily based on the latest EPSS model available.
When computing the risk rating, EPSS percentile supersedes EPSS probability and if the EPSS percentile is above 70th, risk rating is calculated instantly by Kondukto without looking at EPSS probability.
| EPSS Percentile | Risk Rating | Vulnerability Severity |
|---|---|---|
| <70th | Calculated based on EPSS probability | Depends on EPSS probability |
| between 70th and 90th | 3 | High |
| >90th | 4 | Critical |
If the EPSS percentile is below 70th, then the following logic is applied.
| EPSS Probability | Risk Rating | Vulnerability Severity |
|---|---|---|
| between 0% and 10% | 0 | Low |
| between 10% and 30% | 1 | Low |
| between 30% and 70% | 2 | Medium |
| between 70% and 90% | 3 | High |
| between 90% and 100% | 4 | Critical |
How is M-score in Mandiant integration calculated ?
Kondukto calculates the M-score based on the risk rating and exploitation state information provided by Mandiant.
The calculation is based on the matrix below;
| Exploitation State / Risk Rating | Low | Medium | High | Critical |
|---|---|---|---|---|
| Wide | 1,5 | 3,2 | 6,0 | 10,0 |
| Confirmed | 1,3 | 2,7 | 5,0 | 8,2 |
| Available | 1,2 | 2,3 | 4,0 | 6,4 |
| Anticipated | 1,1 | 1,8 | 2,9 | 4,5 |
| No known | 1,0 | 1,3 | 1,9 | 2,7 |
Updated 9 months ago