AI Engine RBP Algorithms
There are three formulas for determining AI Engine RBP:
- AI Engine Rule Risk Rating Inflected
- Destination Impacted Host DRL influence
- Balanced mode—a combination of the above
If AI Engine Rule Risk Rating (RR) = 0, then RBP = 0.
STL and DRL will only be available when the AI Engine Rule is grouped by IP Address (Origin), Host (Origin), Hostname (Origin), IP Address (Dest), Host (Dest), or Hostname (Dest). Both will be known values or both will be unknown—one will never be known and the other unknown. The AIE RBP formulas are different depending on whether the STL and DRL are available. For more information, see the formulas in this section.
Formula Variables
- FPP. False Positive Probability
- FPPw. False Positive Probability weight
- STL. Source Threat Level
- STLw. Source Threat Level weight
- DRL. Destination Risk Level
- DRLw. Destination Risk Level weight
- DRLi. Destination Risk Level influence
- RR. Risk Rating
- RRw. Risk Rating weight
- RRi. Risk Rating influence
Risk Rating Influence (STL/DRL Known)
STL and DRL are determined based on the same logic as the general RBP calculation.
Risk Rating Influence (STL/DRL Unknown)
When only one of the hosts is present: Previously, if one of the hosts was missing, then Priority would not be calculated. Now, if one of the hosts is missing, a Risk Rating of 0 is used for the missing host, which essentially drops either the STL or DRL term from the calculation.
Impacted Host Influence (STL/DRL Known)
STL and DRL are determined based on the same logic as the general RBP calculation.
Impacted Host Influence (STL/DRL Uknown)
When only one of the hosts is present: Previously, if one of the hosts was missing, then Priority would not be calculated. Now, if one of the hosts is missing, a Risk Rating of 0 is used for the missing host, which essentially drops either the STL or DRL term from the calculation.
Balanced Equation (STL & DRL Known)
STL and DRL are determined based on the same logic as the general RBP calculation.
Balanced Equation (STL & DRL Unknown)
When only one of the hosts is present: Previously, if one of the hosts was missing, then Priority would not be calculated. Now, if one of the hosts is missing, a Risk Rating of 0 is used for the missing host, which essentially drops either the STL or DRL term from the calculation.