Scoring Profiles

This guide describes the scoring profiles Stella Ops offers and when to use each one. It is written for policy authors, security leads, and operators choosing how vulnerability findings are evaluated and scored.

For the underlying signals and YAML knobs, see Signals Weighting and Score Policy YAML.

Overview

Stella Ops supports multiple scoring profiles to accommodate different needs, from simple transparent scoring to advanced entropy-based analysis. A scoring profile determines how vulnerability findings are evaluated and turned into a risk score.

Available Profiles

Simple Profile

The Simple profile uses a transparent 4-factor basis-points weighted formula:

riskScore = (wB × B + wR × R + wE × E + wP × P) / 10000

Where:

• B (Base Severity): CVSS score × 10 (0-100 range)
• R (Reachability): Hop-based score with gate multipliers
• E (Evidence): Evidence points × freshness multiplier
• P (Provenance): Level-based score (unsigned to reproducible)
• wB, wR, wE, wP: Weight basis points (must sum to 10000)

Default weights:

Use cases:

• Organizations requiring audit-friendly, explainable scoring
• Compliance scenarios requiring transparent formulas
• Initial deployments before advanced analysis is available

Advanced Profile (Default)

The Advanced profile extends Simple with:

• CVSS version adjustment: Scores weighted by CVSS version (4.0 > 3.1 > 3.0 > 2.0)
• KEV boost: +20 points for Known Exploited Vulnerabilities
• Uncertainty penalty: Deductions for missing data (reachability, evidence, provenance, CVSS version)
• Semantic category multipliers: Entry points and API endpoints scored higher than internal services
• Multi-evidence overlap bonus: 10% bonus per additional evidence type
• Advanced score passthrough: Uses pre-computed advanced scores when available

Use cases:

• Production deployments with full telemetry
• Organizations with mature security programs
• Scenarios requiring nuanced risk differentiation

Custom Profile (Enterprise)

The Custom profile allows fully user-defined scoring via Rego policies. Requires:

• Valid Rego policy path
• Policy Engine license with Custom Scoring feature

Configuration

Score Policy YAML

Add the scoringProfile field to your score policy:

policyVersion: score.v1
scoringProfile: simple  # Options: simple, advanced, custom

weightsBps:
  baseSeverity: 1000
  reachability: 4500
  evidence: 3000
  provenance: 1500

# ... rest of policy configuration

Tenant Override

Tenants can override the default profile via the Scoring Profile Service:

// Set profile for a tenant
scoringProfileService.SetProfileForTenant("tenant-id", new ScoringProfileConfig
{
    Profile = ScoringProfile.Simple
});

// Remove override (revert to default)
scoringProfileService.RemoveProfileForTenant("tenant-id");

API Integration

Scoring with Default Profile

var result = await profileAwareScoringService.ScoreAsync(input);
// Uses tenant's configured profile

Scoring with Explicit Profile

var result = await profileAwareScoringService.ScoreWithProfileAsync(
    input,
    ScoringProfile.Simple);

Profile Comparison

var comparison = await profileAwareScoringService.CompareProfilesAsync(input);
// Returns scores from all profiles for analysis

Audit Trail

All scoring results include profile identification:

{
  "finding_id": "CVE-2024-12345-pkg-1.0.0",
  "scoring_profile": "simple",
  "profile_version": "simple-v1",
  "raw_score": 65,
  "final_score": 65,
  "severity": "medium",
  "signal_values": {
    "baseSeverity": 75,
    "reachability": 70,
    "evidence": 45,
    "provenance": 60
  },
  "signal_contributions": {
    "baseSeverity": 7.5,
    "reachability": 31.5,
    "evidence": 13.5,
    "provenance": 9.0
  },
  "explain": [
    { "factor": "baseSeverity", "value": 75, "reason": "CVSS 7.5 (v3.1) with version adjustment" },
    { "factor": "evidence", "value": 45, "reason": "45 evidence points, 14 days old (90% freshness)" },
    { "factor": "provenance", "value": 60, "reason": "Provenance level: SignedWithSbom" },
    { "factor": "reachability", "value": 70, "reason": "2 hops from call graph" }
  ]
}

Migration Guide

From Legacy Scoring

1. Audit current scores: Export current scores for baseline comparison
2. Enable Simple profile: Start with Simple for predictable behavior
3. Compare profiles: Use CompareProfilesAsync to understand differences
4. Gradual rollout: Move to Advanced when confidence is established

Profile Switching Best Practices

• Test in staging first: Validate score distribution before production
• Monitor severity distribution: Watch for unexpected shifts
• Document changes: Record profile changes in policy lifecycle
• Use replay: Re-score historical findings to validate behavior

Determinism

Both Simple and Advanced profiles are fully deterministic:

• Explicit time: All calculations use AsOf timestamp
• Integer math: Basis-point arithmetic avoids floating-point drift
• Stable ordering: Explanations sorted alphabetically by factor
• Input digests: Track input hashes for replay validation

Performance

Related Documentation

• Score Policy YAML
• Signals Weighting
• VEX Trust Model
• Policy Overview