Severity Engine

Evaluate an alert and return a structured severity decision.

Use this tool to score a single alert based on the context, risk factors, and confidence details you provide.

Complete the form, submit it to the severity engine, and review the resulting severity, score, confidence, reasons, and recommended action.

Alert Context

Capture the core alert metadata before scoring.

Alert Source Detection System Rule Name Alert ID Timestamp Source IP Destination IP Affected User Affected Host

Risk Factors

Select the conditions that should influence the severity score.

Indicator Reputation Asset Criticality User Privilege External Connection Lateral Movement Persistence Data Exfiltration Malware Evidence Execution Evidence Multiple Alerts

Confidence / Notes

Add analyst context without generating a full report.

Confidence Notes

MyDuckSS

Severity Engine

Alert Context

Risk Factors

Confidence / Notes

Severity Decision

Reasons

Recommended Action