I'm trying to understand how to update the severity of a notable event when a new event arrives with a normal severity. I'm feeding external alerts into ITSI and a correlation search turns it into a notable event. I'm using a specific ID for the "Notable Event Identifier Fields". These alerts correctly turn into notable events and placed into an episode. When the same alert comes into ITSI, but with a "Normal"\2 severity, I expect it to change the severity of the prior notable event in the episode. Instead, it will treat it like a new notable event and put it into the same episode. I thought ITSI uses the Notable Event Identifier Fields to determine if two events are the same or not. I checked that both the original event and the "clearing" event have the exact same event_identifier_hash, so why does ITSI treat it like an additional alert\event in the episode? Instead of having one normal\clear event in the episode, I now have one critical and one normal.
How are you supposed to update the status of an alert\notable event in an episode when a clearing event is received?
