Severity labels lose meaning the moment every ticket is marked critical. We see this most often when a regional phishing wave hits several tenants at once and analysts copy the previous ticket’s rating to save time.
Start by separating detection urgency from business impact. A noisy rule that fires a hundred times may still deserve a high detection urgency, yet only a handful of those events will touch payment systems or customer data. Your views should show both dimensions without forcing them into one colour.
Agree on three to five severity phrases that appear in tickets, handoffs, and external incident reports. If the overnight shift uses different words from the day shift, your analytics will never reconcile.
Finally, review one week of closed tickets with the duty managers present. Ask which severity decisions they would reverse. Those reversals become the thresholds your visuals should emphasise.