Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.idemeum.com/llms.txt

Use this file to discover all available pages before exploring further.

​
Overview

When idemeum captures an application event (either execution event for allowlisting or elevation event for elevation control), it calculates a confidence score for that application.
Confidence score determines how confident we are that allowing execution or elevation of this app is save in our environment. For each application we look at more than 20 signals, calculate the score as a weighted sum across independent signal groups, and then present the score as a recommendation zone.
We look at the following signal categories:
CategoryDefinition
Identity trustCapturing signals that represent the metadata of the application, including signature, verified publisher, OS binary, etc.
Execution context riskCapturing signals related how application executes, from what path, under what context, what is the parent process chain and more.
Prevalence and historyCapturing stats how prevalent this application is across idemeum customers and how and when it was seen in your environment.
Malware verdictCapturing signals, reputation and metadata returned by Sophos reputation API
Policy trustWhat rules the application matching
At the end of the scoring computation we return the confidence zone for each application:
  • hard block - certainly malicious
  • high risk - likely unsafe to allow
  • ambiguous- applications and needs careful review
  • soft allow - likely safe to allow for the organization
  • allow - high confidence of a safe application
Here is the example of the confidence score calculation: 
- Signed by Microsoft
- Standard User + running from Program Files
- Low Tenant Prevalence
- CLEAN Reputation
- Publisher allow rule

=  89.5

—>  High Confidence Allow

​
Where confidence score is shown

Confidence score is shown in all places where you are interacting with an application event:
  • For each application event in the portal in the Events table
  • For each elevation or execution request in the web portal
  • Mobile request notifications
  • Email admin notifications
  • Tickets we create in the ticketing system
Here is the example of the confidence score displayed in the admin portal Events view:
Clean Shot 2026 04 16 At 12 34 58@2x