Icons denote information such as the following:
The tag or tags associated with the threat or correlation.
The devices that generated alerts associated with the threat or correlation.
The status of the threat and the user (if any) assigned to handle the threat.
Information is displayed when you hover over an icon.