Setting aside the risk piece for a moment, I wanted to see if you had a priority assigned for the asset that is associated with the event. The urgency is driven by the severity of the correlation search, which sounds like you have set to high, combined with the priority of the asset impacted. Priority is set in the same manner, unknown, info, medium, high, critical. If the priority is not set for the asset, is it possible this is what is driving the urgency? There is a matrix/lookup in Configure -> Data Enrichment -> List and Lookups called Urgency Levels. This can be edited to accommodate a specific organization's settings. By default, a high severity correlation search, combined with an unknown asset priority would equate to a medium urgency.
Hopefully this helps resolve the notable event / urgency piece.
... View more
