We need better information set in the various event fields. I would recommend looking at the "WindowsMonitor" ZenPack and at its zeneventlog.py daemon code to see how severities are mapped, and how eventClassKey is set at the very least.