Confidence score
Every resource has a confidence score: Red Kite's estimate of how likely the resource is to belong to its project. It is shown as a bar in the Confidence column of the resource tables, and it can be used in filters.
Levels
| Level | Score | Filter | Meaning |
|---|---|---|---|
| Verified | - | confidence:verified | A user confirmed that the resource belongs to the project. |
| Likely | 75 - 99 | confidence:likely | The resource very probably belongs to the project. |
| Suspected | 50 - 74 | confidence:suspected | The resource may belong to the project. |
| Unlikely | 0 - 49 | confidence:unlikely | The resource probably does not belong to the project. |
The comparison operators also work, with a level or a number: confidence.gte:likely, confidence.lt:50.
How the score is computed
The score depends on how the resource was found:
- A resource added manually has a score of 100.
- A resource found by a job gets the score of the resource the job started from, minus a penalty that depends on how reliable the job is. For instance, resolving a domain name is very reliable, while a passive discovery job is much less so.
- A subdomain inherits the score of its parent domain, and a host inside one of the project's IP ranges inherits the score of that range.
A verified resource is always considered as belonging to the project, whatever its score. See Data enrichment.
Confidence and automation
Red Kite only runs its automation on resources with a confidence of 50 or more (suspected, likely or verified). Unlikely resources are kept and shown, but they are not scanned further. This prevents Red Kite from drifting away from your attack surface and scanning infrastructure that is not yours.
Verifying an unlikely resource that belongs to you brings it into the automation.