First-time evaluator - how does their risk-based alerting actually work?

Hey everyone, been lurking for a bit but finally diving into a POC for privileged access management. We're a heavy HubSpot/Marketo shop, so I'm used to building complex, logic-based workflows for lead scoring and alerts. That's why CyberArk's "risk-based alerting" is the feature that really caught my eye on the spec sheet.

But the vendor materials are... high-level. They talk about dynamic risk scoring and adaptive responses, which sounds fantastic in theory. In my world, that would be like a lead scoring model that triggers a specific nurture stream based on a combination of page visits, form fills, and email engagement. I'm trying to understand the actual *workflow mechanics* behind CyberArk's version.

For those of you who have implemented it, could you walk me through a concrete, step-by-step example of how this works in practice? For instance:

* What are the actual **inputs** that feed the risk score? Is it just things like command executed and target system, or does it pull in contextual data from other systems (like a SIEM or ITSM)?
* How granular is the **rule-building**? Can I set up multi-condition logic like: "IF user is from a non-corporate IP AND accesses a tier-1 server AFTER hours AND runs 'powershell.exe' THEN risk score increases by X points"?
* What are the **actionable outputs**? Is it just "High Risk Alert" in a dashboard, or can it trigger automated, step-up responses? For example:
* Auto-initiate a session recording for review.
* Require an additional approval from a manager in real-time.
* Inject a step-up MFA challenge mid-session.
* Create a ticket in ServiceNow automatically.

I'm less interested in the marketing promise and more in the practical, operational reality. How much of this is out-of-the-box versus needing heavy customization? Does it feel like a truly integrated workflow engine, or more like a set of static thresholds?

Any insights you can share from your implementation would be incredibly helpful as we try to map this to our actual security playbooks.

- Al