FORTIS Logic
Overview
This page provides an explanation of how Risk Scores are calculated for various cybersecurity-related reports in Power BI. These scores are designed to help prioritize security events based on severity, action type, and IP classifications.
Risk Score Range
Detected malware or direct threat activity.
Strong indicators of potentially malicious behavior.
Suspicious behavior needing further investigation.
Benign but logged for visibility.
General activity.
| Condition | Risk Score |
|---|---|
| [Firewall Action] is "detected" AND [Event Type] is NOT in the excluded list* | 5 |
| [Firewall Action] is "monitored" AND [Event Type] is NOT in the excluded list* | 5 |
| [Firewall Action] is "passthrough" AND [Event Type] is NOT in the excluded list* | 5 |
| [Firewall Action] is "blocked" AND both Source & Destination IPs are private | 4 |
| [Firewall Action] is "dropped" AND both Source & Destination IPs are private | 4 |
| [Firewall Action] is "blocked" (all other cases) | 2 |
| [Firewall Action] is "dropped" (all other cases) | 2 |
| Anything else | 1 |
| No Logs | 1 |
Excluded Event Types*
- FortiGate-antivirus-file-oversize
- FortiGate-antivirus-scan-archive-oversize-notif
- FortiGate-antivirus-scan-archive-corrupted-notif
- FortiGate-antivirus-file-submitted
- FortiGate-antivirus-scan-archive-multipart-notif
- FortiGate-antivirus-file-monitored
Anti-Malware Report - Key Conditions
Application Control Report - Key Conditions
| Firewall Action | AppCtrl Security Risk | Count | Risk Score |
|---|---|---|---|
| Pass | Yes | > 10,000 | 5 |
| Pass | Yes | ≤ 10,000 | 4 |
| Block | Yes | Any | 3 |
| Block | No | Any | 2 |
| Pass | No | Any | 1 |
| No Logs | N/A | Any | 5 |
Is Your Business Vulnerable Against Cyber Threats?
Most organizations are unaware of cybersecurity threats and what steps to take when there is a breach. Cyber attacks compromise valuable data, including corporate and financial information. For businesses that deal directly with customers, a cyber attack can result in loss of sales and reputational damage.
Organizations that want to protect their data require cybersecurity assessments to uncover gaps between what is in place and what is required by the framework.
LCM works with industry leading cybersecurity frameworks to provide the best possible analysis of your current level of security. Our team of experts can customize cybersecurity assessments based on your specific business, customer, or partner requirements.
Are you protected?
Connect with our experts to start your Cybersecurity Assessment.
LCM -A Leader In Security
Stay updated with the latest news and trends in cybersecurity
