Removing the outdated URL-IP relationship clears the incorrect linkage, and enriching the URL indicator updates it with the current resolution and context so future alerts reflect the right association.

Assigning those accounts to the Executive Accounts asset role elevates and visually highlights any alerts tied to their hosts, making them stand out for analyst review.

Matching the company name in a certificate's Subject Organization field is a heuristic text match and provides the weakest attribution confidence compared with registrar records, name server ownership, or manual analyst validation.

When a playbook trigger is configured for an alert--regardless of severity-- the playbook will automatically run when the alert is grouped into an incident, unless a severity condition is specifically configured in the playbook trigger. By default, the playbook will execute for any alert (including low severity) as soon as it is grouped within an incident.
"A playbook that is configured as a trigger for an alert will automatically execute when that alert is grouped as part of an incident, independent of the alert's severity unless a specific severity threshold is set."