Threat Weight Fields

[jodros]

We have 3600c's running 5.2.4.  Threat weight is enabled and I am seeing crscore and craction data in log events.  The field crscore seems to indicate the value configured for a specific event based on the threat weight.  However I am not sure what craction is indicating.  All documentation says is that it is the action taken by threat weight.  Values I am seeing are somewhat random.  Do these values line up with some sort of internal table/chart of threat weight actions?  Any insight into the craction field would be appreciated.

Thanks

[neonbit]

Hello,

You can fine tune the Threat Weight variables under Log & Report > Log Config > Threat Weight.

From here you can configure the value for each risk level, and what risk level you want each 'threat' to have.