When we create new alerts for testing, we have the correlation search create the notable event with a status of "Testing". This way, any alerts that fire go into Incident Review with a status of "Testing".
The problem is, when we are ready to move them out of testing, we change the notable event configuration to have a status of "New". But when we change that configuration, it changes all of the old notable events that fired with a "Testing" status to "New" which throws off metrics because suddenly there's an influx of notable events that show up as being "New" even though they were previously in status "Testing."
Is there a way to change the default status for notable events and have it NOT change the old ones that previously fired with the old default status?
