Hi, We have correlation search with action as notable. Initially we made it low Severity on notable to monitor and set threshold . when we changed the severity to high for same notable all the old low severity notable events changed to High automatically. (this search is on data model so dose not have any eval urgency in search). How to avoid changing old notable event severity ? we just want new alerts to be with high urgency not change the old once.
... View more