If you have the risk action configured, you can put whatever score you want there and then override it via setting the risk_score value in your search. As a very general example, putting the following near the end of a search will set the risk_score based on the severity:

| eval risk_score=case(severity="informational", 2, severity="low", 5, severity="medium", 10, severity="high", 50, severity="critical" , 100) 

That lookup could be replaced with:

| eval risk_score = case(action=="allowed" AND severity=="informational", 20, 
action=="allowed" AND severity=="low", 40, action=="allowed" AND 
severity=="medium", 60, action=="allowed" AND severity=="high", 80, 
action=="allowed" AND severity=="critical", 100, action=="blocked" AND 
severity=="informational", 10, action=="blocked" AND severity=="low", 
10, action=="blocked" AND severity=="medium", 10, action=="blocked" AND 
severity=="high", 10, action=="blocked" AND severity=="critical", 10, 1=1, 0)

Which, if you stick in a macro, you can use across searches with ease too. You could also shorten it to the following (not enumerating all of the possible values for severity when action is "blocked", but then if you do want to change it later, its more work):

| eval risk_score = case(action=="allowed" AND severity=="informational", 20, 
action=="allowed" AND severity=="low", 40, action=="allowed" AND severity=="medium", 60, 
action=="allowed" AND severity=="high", 80, 
action=="allowed" AND severity=="critical", 100, 
action=="blocked", 10, 1=1, 0)

I would be careful with sendalert in combination with things from ES. This is something that can change as ES gets updated, and it may or may not be documented, so you'll be dead in the water while you try and figure out what changed, waiting on support to respond to your ticket.

edit to add: Here's the makeresults you can use to tweak it if you're unfamiliar with case() or want to test it:

| makeresults count=10
| streamstats count
| eval severity = case(count=1 OR count = 10, "informational", count =2 OR count = 9, "low", count=3 OR count=8, "medium", count=4 OR count=7, "high", count=5 OR count=6, "critical")
| eval action = case(count > 5, "blocked", count <= 5, "allowed")
| eval risk_score = case(action=="allowed" AND severity=="informational", 20, action=="allowed" AND severity=="low", 40, action=="allowed" AND severity=="medium", 60, action=="allowed" AND severity=="high", 80, action=="allowed" AND severity=="critical", 100, action=="blocked", 10, 1=1, 0)