> ## Documentation Index
> Fetch the complete documentation index at: https://docs.levelblue.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Priority Field for Alarms

<Icon icon="users" iconType="solid" /> Role Availability | ✔️ Read-Only ✔️ Investigator ✔️ Analyst ✔️ Manager

In USM Anywhere, all alarms have a Priority field, which indicates the importance of the alarm. This is a measurement to determine the impact of the alarm in the network.

The priority field can display Low, Medium, High, or Critical. This text comes from <Tooltip tip="Correlation identifies potential security threats by identifying relationships between multiple types of events occurring in two or more assets.">correlation</Tooltip> and orchestration rules. When you create an orchestration rule, you must enter a priority value between 0 and 100. LevelBlue Labs™ creates the <Tooltip tip="A correlation rule correlates incoming events based on previously defined relationships defined in the correlation directive, associating multiple events, of the same or different event types, from the same data source.">correlation rules</Tooltip> and include a value. The LevelBlue Labs team sets the value for the correlation rules based on the alarm's criticality.

The displayed text in the column of alarms depends on the value that the rule has according to this table:

**Priority Field for Alarms**

| Displayed text | Priority Score     |
| -------------- | ------------------ |
| Low            | Between 0 and 33   |
| Medium         | Between 34 and 66  |
| High           | Between 67 and 90  |
| Critical       | Between 91 and 100 |

<Note>
  When triggered, critical alarms are triaged and addressed immediately. If you have orchestration rules configured to trigger on alarms with a priority of High, enabling the **Critical** toggle will prevent those rules from triggering for alarms that are now set to Critical. To ensure proper functionality, you need to update the orchestration rules to include both High and Critical priorities.
</Note>

Open the details of an alarm to learn the exact value of the priority level. See [Viewing Alarm Details](https://cybersecurity.att.com/documentation/usm-anywhere/user-guide/alarms/viewing-alarms-details.htm) for more information. After you are in the **Alarm Details** page, hover over the priority text and a dialog box will show you the exact value.

<Frame>
  <img src="https://mintcdn.com/levelblue-5324744e/WrTE6tbKG6h4p4xa/images/usm-anywhere/priorityvalue_350x293.webp?fit=max&auto=format&n=WrTE6tbKG6h4p4xa&q=85&s=541034aeb05c07cbc0d1d18eb56146cd" alt="" width="350" height="293" data-path="images/usm-anywhere/priorityvalue_350x293.webp" />
</Frame>

See [Correlation Rules](https://cybersecurity.att.com/documentation/usm-anywhere/user-guide/rules-management/correlation-rules.htm) and [Orchestration Rules](https://cybersecurity.att.com/documentation/usm-anywhere/user-guide/rules-management/orchestration-rules.htm) for more information.