Suricata.eve.alert.severity vs metadata's signature_severity

Rule Signatures
2

Hi @jannitand , thanks for posting! We populate severity after consideration of our metadata ‘guidance’ here: Signature Metadata and we do not reference suricata’s own alert.severity. Does that help?

Thanks,

Rich