Trying to map fields from eStreamer data to the ones needed by IDS data model. One of the fields which comes from Sourcefire is "priority" for which there is an existing field alias ( priority -> severity_id), which works fine.
Since CIM needs the field name to be 'severity', I cloned another field alias ( priority -> severity) from the existing and made sure that it has global permission and is part of the TA for sourcefire, same as the field alias for "severity_id".
Still, only severity_id is working but not the one newly created for "severity". Also tried creating the same on indexer but it didn't work. Here is a screenshot showing both the aliases.