Hi, take a look at page 41 of the ESM 101 guide.  It explains how the priority of the event is calculated - https://www.microfocus.com/documentation/arcsight/arcsight-esm-7.7/pdfdoc/ESM_101/ESM_101.pdf 

Hi, vtham1

Thank you, this is very useful information, but I still don't quite understand how I can test that the priority actually works for my flex connector. The events I provided above were generated by artificial intelligence and are test. How do I get, for example, a high priority level? Does it depend on the content of the event or on the fields for which information is displayed?

Thanks in advance

Bohdan

It's a combination of the event severity (or agent severity) and the other factors mentioned in the guide (model confidence, relevance, severity and asset criticality).  The latter is information that would have to be in ESM.  In short, it would have to do with the asset being present in the network model and further information about it to contribute to the priority.