---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Define the new Risk Score Calculator Rules

# Define the new Risk Score Calculator Rules {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 5 minutes to read

Use the new Risk Score Calculator to define and calculate the risk score of security incidents based on the user-defined criteria, which provide a transparent intelligence scoring of security incidents. The risk score is
auto-calculated for the security incident records.

## Before you begin

Role required: sn_si.admin.

Activate the new Risk Score Calculator by setting the `sn_si_aw.activate_new_risk_score_calculator` system property to true.

## About this task

Define a risk score for the security incident records that are generated based on the user-defined parameters. The base system is provisioned with one risk scoring rule, which can be customized and enabled accordingly.  
Note:  
* By default, the new Risk Score Calculator Rule is inactive, and you need to enable the rule to see the risk score of the security incidents.
* To calculate the risk score for additional related tables other than those available in the base system, refer to [Risk Score Calculator for Additional Related Tables](https://servicenow-prod.fluidtopics.net/h_cJRn~3XrHE_JcMAT417A "The Risk Score Calculator is provisioned with one risk-scoring rule as part of the base system to calculate the risk score of security incidents based on user-defined criteria. However, you can customize and include additional related tables to calculate the risk score.").
{#define-risk-score-calculator-rules-sir__ul_gq3_pdy_hbc}

## Procedure

1. Navigate to WorkspacesSecurity Incident Response WorkspaceAdministration.
2. Navigate to Rules EngineRisk Score Calculator Rule.  
   The Risk Score Calculator Rule page is displayed.  
   Note:  
   * As a part of the base system, you're provided with one predefined risk scoring rule template to view, edit, or modify the risk score. However, you can't create or delete the predefined risk score rule template.
   * The changes you make will apply to any new security incidents or updates to the existing ones. To restate historical scores, use the Recalculate Score action.
   {#define-risk-score-calculator-rules-sir__ul_mfz_k1b_j1e}
3. Select the Risk Score Calculator rule.
4. On the form, fill the fields.  
   {#define-risk-score-calculator-rules-sir__table_mhk_bd3_pyc__entry__2}

   | Field | Description |
   |-|-|
   | Name | Name of the risk score value. For example, Risk Score Calculator. |
   | Overall weightage (Applicable to criteria builder) | Weightage of this field within the risk rule. This field isn't editable and displays the overall weightage calculated by the system based on the weight corresponding to enabled criteria. The overall weightage should always be 100%. |
   | Description | Description of the risk score record. For example, calculates risk score based on weighted sum of predefined criteria scores. |
   | Scoring Criteria | Indicates the scoring criteria for a security incident. You can define the Risk Scoring Criteria using the following options: * Criteria Builder: Use this option to add, edit, or remove, and enable and disable criteria that contribute to risk score calculation and verify that the total aggregated weightage is 100%. * Use Script (Advanced): The scripting feature is an advanced feature to build a custom script that should return the risk score, which is an integer value ranging from 0 to 100. {#define-risk-score-calculator-rules-sir__ul_rgq_h23_pyb} |
   [ ]

   {#define-risk-score-calculator-rules-sir__table_mhk_bd3_pyc}
5. To define the Scoring Criteria using the Criteria Builder, perform the following steps:  
   Note:  
   You can edit or modify the existing criteria or add a new criteria.
   1. To add a new criteria, select the +New criteria action.  
      To ingest and map third-party risk scores, and factor them into security incident risk calculation or prioritization logic, use the External risk score criteria fields. To include NIST complaint incident prioritization, use the Functional Impact, Information Impact, Recoverability fields
   2. Select the Table for which you want to set the criteria.  
      Note:  
      * If the selected table is a security incident, the condition is applied to the security incident record for which the risk score is calculated. If the selected table isn't a security incident, the condition is applied only if the records are related to the security incident for which the risk score is calculated.
      * An additional Aggregate type is added to define the scores based on the number of relations associated with the security incidents.
      {#define-risk-score-calculator-rules-sir__ul_g3l_ck2_gbc}
   3. Select the Type criteria for the selected table.  
      The Type value could either be Field or Aggregate based on the table you choose.
   4. Select the Field criteria for the selected table.  
      If you selected the Type value as Field, then the Field criteria display the field values related to the table. If you selected the Type value as Aggregate, then the Field criteria display the aggregate values related to the table.  
      Note:  
      The Aggregate type supports only Count value.

      For example, if you select the Table criteria as Security Incident, then the Type criteria displays only Field option. The Field criteria display all the Field values related to the table, which could be Severity, Active, and
      so on Similarly, if you select the Table criteria as Affected Users, then the Type criteria displays both Field and Aggregate option. If
      you select the Type as Aggregate, the Field criteria display the aggregate values related to the table, which is Count.
   5. Enter the Weightage of the criteria between 0-100.  
      The overall weightage of all the criteria should be 100%.
   6. Enter the name and a short description of the criteria.
   7. Select the Enable scoring criteria check box to enable the scoring criteria.
   8. Define the Conditions and set the score for the conditions.
   9. You can also add new conditions using the New Condition option, and delete existing conditions using the Delete Criteria icon.
   10. Select Add to add the configured criteria.  
       Figure 1. Scoring Criteria using Criteria Builder
   {#define-risk-score-calculator-rules-sir__substeps_dxn_yj2_gbc}
6. Select the Recalculate Score option to recalculate the risk score.  
   For example, if there are changes to the risk score rule. In that case, you must reapply the scoring rule to the security incidents with the risk score already calculated in the past. Use the Recalculate Score action to trigger the recalculation job.
7. Select Confirm.  
   Note:  
   Once your trigger this action, the process runs in the background and will take a few minutes to complete. You won't be able to make changes until it's finished.
8. To define the Scoring Criteria using Use Script (Advanced) option, perform the following steps:
   1. Use this predefined script to build a custom script that should return the risk score, which is an integer value ranging from 0 to 100.  
      The advanced script field is auto-populated with a function, which takes the parameters current and this function should return the risk score, which is an integer value ranging from 0 to 100.  
      Figure 2. Scoring Criteria using Script (Advanced) option

      Here, the current parameter is the GlideRecord object of the entity (security incident) for which the risk score is being calculated. For the security incidents, it corresponds to the GlideRecord for the
      sn_si_incident table.
   {#define-risk-score-calculator-rules-sir__substeps_wjf_rm2_gbc}
9. To disable the Risk Score Calculator, select Disable.
10. Select Save.
* **[Risk Score Calculator for Additional Related Tables](https://servicenow-prod.fluidtopics.net/h_cJRn~3XrHE_JcMAT417A)**   
  The Risk Score Calculator is provisioned with one risk-scoring rule as part of the base system to calculate the risk score of security incidents based on user-defined criteria. However, you can customize and include additional related tables to calculate the risk score.

**Related concepts**   

* [Set up view of SIR Records](https://servicenow-prod.fluidtopics.net/p99YPRJHUz3SrQBoAXW8UA "This section describes how the related lists are grouped and presented on the SIR Related Records tab for easy navigation.")
* [Configure SI design time investigation](https://servicenow-prod.fluidtopics.net/KsFsXg8CHBvaYTkUnuEOpQ "Use this section to configure security incident design time investigation page to add multiple entry points and its associated records within the Security Incident Response Workspace.")
* [SIR Workspace Related Records](https://servicenow-prod.fluidtopics.net/gsDO~PbQk8zzmwnZXCwg6Q#sir-records "This section consists of the related lists items that are grouped into sections such as associated observables and configuration items.")
* [Configure Shift Handover](https://servicenow-prod.fluidtopics.net/Q04QzNU1caN3mjs4rEUNGg "Configure Shift Handover settings to provide complete shift information to the next shift analysts.")
* [Security Incident Response conference call integration](https://servicenow-prod.fluidtopics.net/88P4jTtlgisR6XEYl1fsMA "The Security Incident Response Conference Call integration enables you to manage and initiate conference call and chat for analysts, managers and affected users.")
* [Configure report templates in Security Incident Response](https://servicenow-prod.fluidtopics.net/VKFCEyFnJHSOxoVttZW0gg "You can create report templates that can be used to generate an incident summary or an executive summary for analysis and sharing.")
* [On-Call scheduling in Security Incident Response](https://servicenow-prod.fluidtopics.net/sPKhH7CGbUOINSD8C3fVaQ "Use On-Call Scheduling in Security Incident Response to view and manage shifts for your analysts.")
* [Category management in Security Incident Response](https://servicenow-prod.fluidtopics.net/zKvvJ~woONAARtQWDnLzkQ "Configure security incident categories and subcategories for granular classification of incidents, which helps you accurately route security incidents.")
* [View and update Security Incident Response system properties](https://servicenow-prod.fluidtopics.net/dQgedytB1~M7u70FoX9_oA "View and update the Security Incident Response Workspace system properties from the Security Incident Response Workspace administration panel to access and update the required properties.")
* [Timeline in Security Incident Response Workspace](https://servicenow-prod.fluidtopics.net/U3c3lwBFolisJEn2MEJSmg "The timeline provides a chronological view of events related to a security incident. Events appear as point events or range events. Administrators can configure which events appear on the timeline and what details are shown in event popovers.")  
**Related tasks**   

* [Create quick filters for Security Incidents and Response Tasks lists](https://servicenow-prod.fluidtopics.net/SzkWp6I2kcU8DCTa3RrrTw "Create quick filters to create reusable, predefined filters that appear on the security incidents and response tasks list pages enabling security analysts to filter the list items without adding the filter conditions each time.")

*[\>]: and then