Why several alarms show as informational under incident review as they are intended to be a medium priority?

[theandypav14]

Utilizing Splunk cloud, I have created quite a few notable events and correlation searches that function normally but I cant figure out why several alarms show as informational under incident review as they are intended to be a Medium priority.

the query does not currently contain anything to change the urgency.

[gcusello]

Hi @theandypav14,

if you're using ES, in the Correlation Search, you can define as Response Actions the Notable opening,

in this form you can also choose Impact and Urgency, then ES calculates the priority using the configured rules.

Ciao.

Giuseppe