# Computing scores

## Overview

A *score* applies either to devices or to users and it offers an evaluation of each object from one or several points of view. The value of a score depends thus on the status of the object with respect to a particular aspect or the combination of different aspects.

In this way, scores reduce the complexity of low level analytics to a single numerical value that has business significance. For instance, instead of dealing with multiple measures of network connectivity and their technicalities, gain instant insight into the connectivity status of a device with the help of a single score that combines all of those measures.

Scores are organized into tree structures of up to five levels. Scores at the lowest level of the tree are called *leaf* scores. A leaf score directly depends either on the computation of an aggregate or on the value of a device or user field. In turn, scores at higher levels of the hierarchy are called *composite* scores. A composite score depends on lower level scores, which may themselves be either composite or leaf scores.

## Leaf scores

To compute a leaf score, provide one of the following inputs:

**Field input**: The value of a field that belongs either to a device or to a user object.**Computation input**: The value of an aggregate that results from an NXQL investigation on devices or users.

The final value of a leaf score is computed by applying a normalization function to the raw input value (field or computation) in order to get a number within a predefined range. For example, a score based on the number of system failures which ranges from 0 to 10 (the higher the better) might have a normalization function that maps 0 failures to value 10, more than 5 failures to value 0, and a number failures between 1 and 4 to a list of decreasing intermediate values.

### Update of leaf scores

Leaf scores whose input is a field of user or device objects are updated every minute. For their part, leaf scores with a computation input are updated either once per day at a specific time or periodically every 15 minutes, 1 hour, or 6 hours, depending on their configuration.

## Composite scores

A composite score is computed by combining the values of the scores at its immediately lower level. To combine the lower level scores, use one of the following operations:

**Average**: Add the scores at the lower level and divide the result by their total number.**Weighted Average**: Similar to the average operation, but with factors (*weights*) that multiply each lower level score to reflect their importance.**Min**: Return the minimum value from the available lower level scores.**Max**: Return the maximum value from the available lower level scores.**Sum**: Add the lower level scores.**Multiply**: Multiply the lower level scores that make up the composite score. Useful for combining closely related scores, for example: the*total logon time*of a device is the*average logon time*multiplied by the*number of logons*.

### Update of composite scores

Composite scores are updated when any of the scores on which the composite score depends is modified. Note thus that the modification of a leaf score at the lowest level of the hierarchy may trigger the recalculation of all scores above it.

## Scope of a score

A score may apply to a particular group of devices or users, and not to all of them. This group is called the *scope* of the score. Define the scope of a score by filtering the targeted objects with a condition on a property. For instance, for a score to apply only to laptop computers, put a filter as the scope of the score that returns those devices whose type is set to **laptop**.