What is the sourcetype of the logs you are searching in the correlation search? If they are Windows logs and you have the Windows TA installed, the TA will add a "severity" alias to Windows logs. The severity added by the TA will interfere with the ES severity that determines the Notable urgency. The simple fix is to only include the fields you need in the correlation search and make sure not to select the "severity" field.
 ... View more