| Option | Description | 
| 1—Information | Port-based traffic (examples: HTTP, SMTP). | 
| 2—Low | Policy-related signatures (examples: IM, P2P, Games) | 
| 3—Medium | Tunneling and scanning activity. | 
| 4—High | Most intrusion-related signatures. | 
| 5—Critical | Same as high severity plus very high impact to servers and end users (examples: CVE-2008-4250, Conficker). |