All Threats include these three options:
Enabled
This setting determines whether to include this threat when generating reports. To include
Override Global
this setting for subordinate devices is used to set custom options (Severity, Bql, Comparison, Count) which will override the matching threat on the server
Severity
determines the color coding for the alert as well as whether or not it's filtered by a severity filter (i.e. filtering out everything below "Major" would eliminate our BQL Threat from the report results if it were set to "Minor")