diff --git a/policy_find.cpp b/policy_find.cpp
index 797f7b8..f785823 100644
--- a/policy_find.cpp
+++ b/policy_find.cpp
@@ -25,6 +25,8 @@
 namespace policy
 {
 
+static constexpr auto HOST_EVENT = "org.open_power.Host.Error.Event";
+
 namespace optional_ns = std::experimental;
 
 /**
@@ -59,17 +61,23 @@
  * @param[in] additionalData - the AdditionalData property contents
  * @param[in] name - the name of the value to find
  *
- * @return optional<std::string> - the data value
+ * @return optional<std::string> - the data value. Will not be empty if found.
  */
 optional_ns::optional<std::string>
     getAdditionalDataItem(const std::vector<std::string>& additionalData,
                           const std::string& name)
 {
+    std::string value;
+
     for (const auto& item : additionalData)
     {
         if (item.find(name + "=") != std::string::npos)
         {
-            return item.substr(item.find('=') + 1);
+            value = item.substr(item.find('=') + 1);
+            if (!item.empty())
+            {
+                return value;
+            }
         }
     }
 
@@ -77,6 +85,129 @@
 }
 
 /**
+ * Returns a string version of the severity from the PEL
+ * log in the extended SEL data from the host, where a PEL stands
+ * for 'Platform Event Log' and is an IBM standard for error logging
+ * that OpenPower host firmware uses.
+ *
+ * The severity is the 11th byte in the 'User Header' section in a PEL
+ * that starts at byte 48.  We only need the first nibble, which signifies
+ * the type - 'Recovered', 'Predictive', 'Critical', etc.
+ *
+ *  type value   |   type     |  returned severity string
+ *  ------------------------------------
+ *  1                Recovered   Informational
+ *  2                Predictive  Warning
+ *  everything else  na          Critical
+ *
+ * @param[in] data - the PEL string in the form of "00 11 22 33 4e ff"
+ *
+ * @return optional<std::string> - the severity string as listed above
+ */
+optional_ns::optional<std::string> getESELSeverity(const std::string& data)
+{
+    // The User Header section starts at byte 48, and take into account
+    // the input data is a space separated string representation of HEX data.
+    static constexpr auto UH_OFFSET = 48 * 4;
+
+    // The eye catcher is "UH"
+    static constexpr auto UH_EYECATCHER = "55 48";
+
+    // The severity is the 11th byte in the section, and take into
+    // account a byte is "BB "
+    static constexpr auto UH_SEV_OFFSET = 10 * 3;
+
+    std::string severity = "Critical";
+
+    // The only values that don't map to "Critical"
+    const std::map<std::string, std::string> sevTypes{{"1", "Informational"},
+                                                      {"2", "Warning"}};
+    if (data.size() <= (UH_OFFSET + UH_SEV_OFFSET))
+    {
+        return {};
+    }
+
+    // Sanity check that the User Header section is there.
+    auto userHeader = data.substr(UH_OFFSET, 5);
+    if (userHeader.compare(UH_EYECATCHER))
+    {
+        return {};
+    }
+
+    // The severity type nibble is a full byte in the string.
+    auto sevType = data.substr(UH_OFFSET + UH_SEV_OFFSET, 1);
+
+    auto sev = sevTypes.find(sevType);
+    if (sev != sevTypes.end())
+    {
+        severity = sev->second;
+    };
+
+    return severity;
+}
+
+/**
+ * Returns the search modifier to use, but if it isn't found
+ * in the table then code should then call getSearchModifier()
+ * and try again.
+ *
+ * This is to be tolerant of the policy table not having
+ * entries for every device path or FRU callout, and trying
+ * again gives code a chance to find the more generic entries
+ * for those classes of errors rather than not being found
+ * at all.
+ *
+ * e.g. If the device path is missing in the table, then it
+ * can still find the generic "Failed to read from an I2C
+ * device" entry.
+ *
+ * @param[in] message- the error message, like xyz.A.Error.B
+ * @param[in] properties - the property map for the error
+ *
+ * @return string - the search modifier
+ *                  may be empty if none found
+ */
+std::string getSearchModifierFirstTry(const std::string& message,
+                                      const DbusPropertyMap& properties)
+{
+    auto data =
+        getProperty<std::vector<std::string>>(properties, "AdditionalData");
+
+    if (!data)
+    {
+        return std::string{};
+    }
+
+    // Try the called out device path as the search modifier
+    auto devPath = getAdditionalDataItem(*data, "CALLOUT_DEVICE_PATH");
+    if (devPath)
+    {
+        return *devPath;
+    }
+
+    // For Host.Error.Event errors, try <callout>||<severity string>
+    // as the search modifier.
+    if (message == HOST_EVENT)
+    {
+        auto callout = getAdditionalDataItem(*data, "CALLOUT_INVENTORY_PATH");
+        if (callout)
+        {
+            auto selData = getAdditionalDataItem(*data, "ESEL");
+            if (selData)
+            {
+                auto severity = getESELSeverity(*selData);
+                if (severity)
+                {
+                    return *callout + "||" + *severity;
+                }
+            }
+        }
+    }
+
+    return std::string{};
+}
+
+/**
  * Returns the search modifier to use.
  *
  * The modifier is used when the error name itself isn't granular
@@ -113,7 +244,7 @@
     for (const auto& field : ADFields)
     {
         mod = getAdditionalDataItem(*data, field);
-        if (mod && !(*mod).empty())
+        if (mod)
         {
             return *mod;
         }
@@ -173,9 +304,24 @@
                                              "Message"); // e.g. xyz.X.Error.Y
     if (errorMsg)
     {
-        auto modifier = getSearchModifier(errorLogProperties);
+        FindResult result;
 
-        auto result = policy.find(*errorMsg, modifier);
+        // Try with the FirstTry modifier first, and then the regular one.
+
+        auto modifier =
+            getSearchModifierFirstTry(*errorMsg, errorLogProperties);
+
+        if (!modifier.empty())
+        {
+            result = policy.find(*errorMsg, modifier);
+        }
+
+        if (!result)
+        {
+            modifier = getSearchModifier(errorLogProperties);
+
+            result = policy.find(*errorMsg, modifier);
+        }
 
         if (result)
         {