Nowadays, Intrusion Detection Systems become an important components of network security, they collect and check events from networks and hosts, looking for signs of security violations. As soon as unnecessary events are detected, IDS triggers alerts to report them, thus, the security administrator take safety measures to stop the attack or repair the compromised system. Normally, this is what IDSs should do, but in practice, IDSs have been observed to generate a huge number of alerts, especially false alerts (i.e., false positives), this make the task of security administrator very difficult, he must analyze each alert manually, either a fake or real threat. This paper proposes an approach to Intrusion Real-Time Risk Assessment, the objective is to evaluate the severity of alerts, minimize false positives, distinguish alerts with low importance and irrelevant one, thereby, report serious alerts that present a real threat to the network system by calculating the Risk of alerts and prioritizing them according to their severity. We will tightly integrate this new model with an existing framework.