PingCastle: the score is not a count of accounts

The score is points

A health-check HTML file shows a score built from the rules in that version of the tool. The number is how those rules scored the directory data that was read. It does not count people, and it does not count events in the security log.

A higher number is a worse score in this tool. It is still a score. Do not turn it into “that many compromised accounts.”

The version is part of the number

Two HTML files from different tool versions can score the same directory differently because the rules changed. Write the version printed on the report next to the score. If the version is missing, write “tool version not on this file.”

A later rerun is a new report. Do not edit the old score so the trend looks smooth.

What to write down

File the HTML name, the date it was generated, the tool version, and the score. If you also cite a finding, cite that finding’s text, not the overall number. The number does not name which finding you mean.

Lab: a score of 72 read as 72 accounts

The lab report ad_hc_lab.internal.html shows score 72 and tool version 3.3 on the cover. A draft tells leadership that 72 accounts are compromised. The report’s account tables were not quoted.

The note says 72 is the score for that file and that version. It does not say 72 accounts. Any account claim has to come from a table in the report, which this draft did not cite.

file: ad_hc_lab.internal.html
tool version: 3.3
score: 72
account table cited: none
write: score 72 for this file and version
not: 72 compromised accounts