Notable modular alerts actions values are not written to index=notable. To display severity or priority or urgency, Incident review will perform rest query to get values of correlation search and display in Incident review. However, I believe there is an option to overwrite severity from in-line search of correlation search. just add below line to your correlation search. | eval severity="informational/high/low"   ... View more