When creating an alert definition that has multiple symptoms, the triggered symptom that sets the criticality is the most critical symptom. The criticality of an alert definition is the level of severity or urgency that the alert indicates, such as Critical, Immediate, Warning, or Informational. The criticality of an alert definition is determined by the highest criticality of the symptoms that are included in the alert definition1. When an alert is generated, the criticality of the alert is set by the most critical symptom that triggered the alert. For example, if an alert definition has two symptoms, one with a criticality of Critical and one with a criticality of Warning, and both symptoms are triggered, the alert will have a criticality of Critical. However, if only the symptom with a criticality of Warning is triggered, the alert will have a criticality of Warning2. References: 1: Policy Alert Definitions 2: Alert Definition Best Practices