Which two components influence the incident score in Cortex XDR? (Choose two)

The incident score in Cortex XDR is a calculated value designed to represent the potential risk of a security event. The score is primarily determined by the severity levels of the individual alerts that are grouped within the incident (A). Additionally, the total number of these correlated alerts (B) influences the score. A higher quantity of alerts, especially those with high or critical severity, will result in a higher overall incident score, which helps security analysts prioritize the most significant threats for investigation.

C. Assigned analyst name: The analyst assigned to an incident is an operational workflow detail and has no bearing on the automated risk calculation of the incident score.
D. Data source type: While data sources generate alerts, the incident score is calculated from the resulting alerts' attributes (severity, count), not the source type itself.

1. Palo Alto Networks, Cortex XDR Administrator's Guide, "Incidents View". The guide states, "Score—Calculated based on the severity of the alerts that make up the incident." This directly supports option A.

2. Palo Alto Networks, Cortex XDR Administrator's Guide, "Incident Scoring". This section details that the score is derived from the severities and number of alerts, confirming that both factors are used in the calculation.