Your network may have specific settings or deployments that affect the way alert relevance works. The following scenarios discuss this:
Management disaster recovery (MDR) – If your network is configured for management disaster recovery, the relevance is calculated separately in each of the Managers.
Simulated blocking – In case an attack is blocked, the alert relevance will be calculated using target host details. The same steps will be followed for Simulated Blocking.