What differentiates incident scoring from alert severity?

In the Cortex XDR platform, an alert is a single, discrete security event detected by an analytics engine. Each individual alert is assigned a severity (e.g., Low, Medium, High, Critical) to categorize its potential impact. An incident is a higher-level construct, representing a collection of related alerts that are automatically grouped and stitched together to form a broader attack narrative. The incident score is a numerical value (0-100) calculated based on the aggregated attributes of all alerts within the incident, including their severities, types, and confidence levels. This score provides a consolidated risk assessment for the entire incident, not just a single alert.