RE: Score not being issued by ThreatIntel Enrichment

Hi, It works. Thanks for the help. Really appreciated. Thanks

Re: Score not being issued by ThreatIntel Enrichment

The threat intel rules will only be run to create a score if the is_alert field is present in the alert message. You can use the enrichments stage to set this based on detections / threat intel / enrichment sources etc. If that field is set true, then you should see your scoring rules run. Simon