topic Re: Severity in correlations in Cortex XSIAM Discussions

Severity in correlations

LeandroKopke — Tue, 04 Feb 2025 16:27:08 GMT

Hello.

Could you help me with the severity field of the correlation?

I need to customize the severity of the alert based on the user who triggers the query.
The query is already made. When I configure the correlation to get this severity, it ignores it and sets any alert as "Medium" whereas the severities were supposed to be "high" or "informational" (this one to open an incident)

Do you know what could be happening and where the incident is inheriting this severity from?

Re: Severity in correlations

A.Elzedy — Fri, 13 Jun 2025 19:09:22 GMT

Hi @LeandroKopke,

I'm assuming that you're already having a dedicated field for severity in your query

such as

| alter alert_severity = json_extract_scalar(_alert_data, "$.severity")

You've already selected user defined and chose the right field to match an item within the dropdown list, other wise, it's gonna set to Medium by default

Would you please share a sample of your query?