Explanation/Reference: https://dev.splunk.com/enterprise/docs/developapps/enterprisesecurity/planintegrationes/

Explanation
The urgency of a notable event is a value that indicates how important or urgent the event is for investigation and response. The urgency of a notable event is determined by two fields: the priority and the severity. The priority is a value that is assigned to an asset or an identity based on how critical or valuable it is for the organization. The priority can be unknown, low, medium, high, or critical. The severity is a value that is assigned to a notable event based on how serious or harmful the event is for the security posture. The severity can be unknown, informational, low, medium, high, or critical. The urgency of a notable event is calculated by combining the priority and the severity values using a lookup table called urgency_lookup. The urgency can be informational, low, medium, high, or critical. You can use the urgency field to prioritize the investigation of notable events in Splunk Enterprise Security. References = How urgency is assigned to notable events in Splunk Enterprise Security Priority and severity in Splunk Enterprise Security

Explanation
Explanation/Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Admin/Customizenotables

Explanation/Reference: https://docs.splunk.com/Documentation/ES/latest/Admin/Configureadaptiveresponse