Threat Scoring Quick Reference
import { LinkCard } from ‘@astrojs/starlight/components’;
This page provides a quick reference for threat scores. For a comprehensive deep-dive into how scoring works, see the Core Concepts guide.
Quick Reference
Section titled “Quick Reference”Score Ranges
Section titled “Score Ranges”| Score | Level | Confidence needed | Action |
|---|---|---|---|
| 0-20 | MINIMAL | none | Allow |
| 21-40 | LOW | none | Log |
| 41-60 | MEDIUM | 30% | Challenge |
| 61-80 | HIGH | 50% | Block |
| 81-100 | CRITICAL | 70% | Block + Alert |
The level is gated by confidence as well as by score: a 90 the scorer is only 40% confident in is reported as MEDIUM.
Detection Categories
Section titled “Detection Categories”| Category | Weight | Reliability |
|---|---|---|
| Honeypot Signals | 38% | Highest |
| Attack Signatures | 24% | High |
| Browser Fingerprint | 11% | Medium |
| Behavioral Analysis | 10% | Medium |
| TLS Fingerprint | 7% | Medium |
| Geo Consistency | 5% | Low |
| IP Reputation | 3% | Low |
| HTTP Headers | 1% | Low |
| User Agent | 1% | Low |
Those are the defaults, which apply to browser-observed detections. Decoy links and the edge sensor re-scale the weakest categories, because most of the default budget is unreachable for them.
Threat Categories
Section titled “Threat Categories”| Category | Meaning |
|---|---|
| Attacker | Active exploitation attempt |
| Bot | Automated with fingerprint anomalies |
| Scanner | Triggered honeypot/decoy |
| Crawler | Known crawler User-Agent |
| Scraper | Fingerprint anomalies only |
| Legitimate | Normal human visitor |
Viewing Scores
Section titled “Viewing Scores”In the Detections Table
Section titled “In the Detections Table”The Threat Score column shows the unified score (0-100). The Category column shows the threat classification.
In Detection Details
Section titled “In Detection Details”Click any detection row to open its flyout. The Threat Score Breakdown there is specific to that detection: it lists the signals that actually moved the score, with the points each added, the description the scorer wrote for it, and a bar comparing it to the other contributors.
Three things worth knowing before reading one:
- The listed points do not sum to the score. Categories are weighted and capped, so the parts genuinely do not add to the whole, and the panel says so rather than printing arithmetic that fails on inspection.
- A signal’s ceiling is shown only when the signal did not reach it. “+40 of 40” is noise; “+10 of 30” tells you this one was dialled down and could have been worse.
- Signals that scored zero are dropped from the list. The radar chart beside it is where “we looked and saw nothing” lives.
See Viewing Detections for the full walkthrough.
The general explainer
Section titled “The general explainer”A How scoring works link at the foot of the breakdown opens the system-wide explanation. That link used to be the score’s own affordance, which meant clicking a specific 87 opened a glossary that never mentioned your detection.
Filtering by Score
Section titled “Filtering by Score”Use the filters panel to narrow detections:
- By Score Range: Set min/max thresholds on the Threat Score panel
- By Category: Select specific threat types on the Threat Category panel
Common Questions
Section titled “Common Questions”Q: Why is my score different from the sum of signals?
A: Scores are weighted averages, not sums. A honeypot score of 30 contributes 30 × 38% = 11.4 points, not 30 points. This is also why the per-detection breakdown says explicitly that its listed points do not add up to the total.
Q: What does “Unknown” category mean?
A: This was a legacy category. All detections are now classified as one of: Attacker, Bot, Scanner, Crawler, Scraper, or Legitimate.
Q: Why is confidence low?
A: Confidence reflects how many signal categories contributed, plus boosts for high-reliability evidence. With only 1-2 categories active, confidence is lower. The fingerprint boost additionally requires at least one fingerprint flag that is reliable on its own, such as a webdriver or headless marker, so a stack of weak hints can no longer supply the confidence that justifies trusting itself.
Q: Why is a verified crawler scoring 60 and not higher?
A: A detection whose declared identity was verified is capped at 60, the top of MEDIUM, unless it also did something hostile such as tripping a honeypot or carrying an attack signature. Verified crawler fleets trip the datacenter, VPN and automation heuristics constantly, and are not hiding. See Verified identity changes what the numbers mean.
Q: Why did a spike in a crawler’s addresses stop raising its score?
A: Rotation across many addresses escalates the score for undeclared clients, because that is how scrapers evade IP blocks. It is skipped for verified agents, where the spread is fleet infrastructure rather than evasion. Spoofed and unverified claims still escalate.
For complete documentation on scoring methodology, category weights, and classification logic, see the Threat Scoring Core Concepts guide.