# How do elastic Apply Severity to pre-built rules?

**URL:** <https://discuss.elastic.co/t/how-do-elastic-apply-severity-to-pre-built-rules/276437>\
**Category:** Elastic Security\
**Tags:** detection-rules\
**Created:** [June 19, 2021, 1:24pm UTC](https://discuss.elastic.co/t/how-do-elastic-apply-severity-to-pre-built-rules/276437 "2021-06-19T13:24:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Oliver2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/oliver2/32/76684_2.png) [@Oliver2](https://discuss.elastic.co/u/Oliver2)\
**Post date:** [June 19, 2021, 1:24pm UTC](https://discuss.elastic.co/t/how-do-elastic-apply-severity-to-pre-built-rules/276437/1 "2021-06-19T13:24:54Z")

</div>

How is the pre-built detection rules severity worked out, is it a random number or is there some documented framework i cant seem to find any notes on it?

---

<div class="post-metadata">

**Author:** ![spong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spong/32/54343_2.png) [@spong](https://discuss.elastic.co/u/spong)\
**Post date:** [June 24, 2021, 11:49pm UTC](https://discuss.elastic.co/t/how-do-elastic-apply-severity-to-pre-built-rules/276437/2 "2021-06-24T23:49:54Z")

</div>

Hey there @Oliver2 👋 Thanks for posting!

While I couldn't find any documents referencing specific mappings from say MITRE Tactics and Techniques to a certain Severity/Risk Score, we do document a bit of our philosophy around Rule Development and what makes a good rule [over here](https://github.com/elastic/detection-rules/blob/main/PHILOSOPHY.md#approach) in the detection-rules repo. From there, it's a combination of author interpretation, categorization and expertise as well.

Hope that helps! Cheers!

Garrett

---

<div class="post-metadata">

**Author:** ![peter\_luo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/peter_luo/32/84516_2.png) [@peter\_luo](https://discuss.elastic.co/u/peter_luo)\
**Post date:** [June 25, 2021, 4:20am UTC](https://discuss.elastic.co/t/how-do-elastic-apply-severity-to-pre-built-rules/276437/3 "2021-06-25T04:20:21Z")

</div>

Just to add some on top of Garrett's response based on my years' experience working on SOC center for large enterprises, risk score should contain two parts

- how likely it is going to be true attack
- what is the impact of this attack to your own environment  
Besides, risk score should be dynamic changing to reflect the changes in environment and resolutions of similar alerts.  
The built in rules have set up a good foundation but may need customization for your own environment.

This blog may be relevant. [Don't take security risk score personally](https://www.dtonomy.com/risk-score/)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 23, 2021, 4:20am UTC](https://discuss.elastic.co/t/how-do-elastic-apply-severity-to-pre-built-rules/276437/4 "2021-07-23T04:20:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.