Hi Box Community,
We're excited to share a new enhancement to Box Shield Threat Protection! Going forward, threat alerts will feature a new Severity field to help admins prioritize and remediate security events faster and more accurately. This change went live on October 13, 2026.
What’s Changed?
-
New Severity Field & Sorting: Alerts are automatically be categorized as Low, Medium, High, or Critical (calculated using existing Risk Scores). Admins will also be able to sort the threat feed by severity.
-
Retiring Alert Priority: The Alert Priority field is retired across the Box UI and Shield events.
-
Risk Score in UI: Risk Score is no longer display in the alert UI, but will remain accessible in the alert event payload and Box event stream for uninterrupted integration support.
-
Alert ID Update: The format of Alert IDs are updated to a new string value rather than the previous number format.
What Action Do I Need to Take?
For most customers, no action is required. However, if your team has custom integrations or automated workflows referencing the Alert Priority field, be sure to update them to use the new Severity levels. Our Box corporate security team has provided a great walkthrough for how to make sure your SIEM is properly ingesting these new values - check it out here.
This update is available to all organizations with Box Shield. If you have questions or need guidance preparing for this change, feel free to comment below or contact your account team / Product Support!