version: "ueba-rule-v1"
baseline_status: "per_user_department_baseline_skeleton"
score_cap: 100

weights:
  dlp_fail: 35
  dlp_warn: 20
  open_incidents: 15
  night_activity: 20
  weekend_activity: 20
  workforce_drop: 15
  workforce_anomaly: 10
  application_classification_gap: 10
  application_classification_gap_large: 15
  worktime_unavailable: 25
  baseline_deviation: 15

confidence:
  base: 0.55
  evidence_bonus: 0.10
  screenshot_bonus: 0.10
  worktime_bonus: 0.15
  policy_bonus: 0.10