Reference C: Severity mapping

How SARIF severity levels map to Cortex Cloud severity values.

The platform resolves severity in this order:

1. It checks runs[].results[].level on the finding.
2. If absent, it checks runs[].tool.driver.rules[].defaultConfiguration.level on the matching rule.
3. If neither field exists, it assigns High severity.

SARIF level	Cortex Cloud severity
error	HIGH
warning	MEDIUM
note	LOW
none or absent	HIGH (default)