Again, this is duplicated from PayloadRegexDecoder, might make sense to put the severity map lookup stuff in a utility function.