By "qualify", I assume you mean captured in your risk log. Although used this way, I don't think the log was ever intended to capture the universe of risks threatening a given project. I think you focusing on five--although I would not have a rule of five--is a good way to focus the team on what matters.
The general rule I use is to capture a risk in a formal way--risk log, documented risk assessments, mitigation plans, etc.--for those threats that 1) require formal communication/escalation to some stakeholder group; 2) require formal approvals for allocating resources to mitigate the threat(s) and/or create contingency reserves; 3) the threat is such you need/want to monitor mitigation progress; or 4) CYA when you cannot get anyone to listen.
Organic risks, such as weather, typically would not meet one of these criteria. I define organic risks as naturally produced by the project or by nature, everyone knows them inherently, and mitigation is often "built-in" the project plans anyway. I have, however, documented a few organic risks from time to time because of something rather unique about the organic threat. For example, on one project, we had a ton of work to do over the holidays during the winter and most of the workers traveled in. It seemed everyone was optimistically ignoring the possibility of no travel caused by weather and the fact the most people like to take vacation during the holidays. Therefore, since everyone was on the happy path, I escalated this risk because it met my criterion #4.