What it is
Every entity (host, user, address or hash) carries a risk score built from the alerts it appears on over the last seven days. Recent and severe alerts count most, and the score rises faster when several different detections point at the same entity. A host with one medium alert has a modest score; a host flagged by the endpoint, the firewall and the identity provider has a high one.
Where it shows
The Hosts page, the Entity risk tab of the Correlations page, and the riskiest-hosts card on the Overview page.
How to use it
When severity alone does not separate alerts, check the risk of the entities they name. Treat a rising score on a host with no critical alert as a reason to look. Read the score together with the alerts behind it when deciding what to do.