title: WAZUH/OSSEC - overwriting rules doesn't seem to work
body: <p>I'm trying to overwrite a rule as per documentation, like this</p>
  
  <p><a href="https://documentation.wazuh.com/3.12/learning-wazuh/replace-stock-rule.html" rel="nofollow noreferrer">https://documentation.wazuh.com/3.12/learning-wazuh/replace-stock-rule.html</a></p>
  
  <p>So I've copied one rule to local_rules.xml, created my own group (prior to that also tried to put it within the rule's original group tag), but it seems to be completely ignoring it:</p>
  
  <p>This is what I've put in local_rules.xml:</p>
  
  <pre><code>&lt;group name="istvan"&gt;
      &lt;rule frequency="8" id="31533" level="9" overwrite="yes" timeframe="20"&gt;
          &lt;if_matched_sid&gt;31530&lt;/if_matched_sid&gt;
          &lt;same_source_ip/&gt;
          &lt;description&gt;High amount of POST requests in a small period of time (likely bot).&lt;/description&gt;
          &lt;group&gt;pci_dss_6.5,pci_dss_11.4,gdpr_IV_35.7.d,nist_800_53_SA.11,nist_800_53_SI.4,&lt;/group&gt;
      &lt;/rule&gt;
  &lt;/group&gt;
  </code></pre>
  
  <p>I've only changed the level to 9 and added the overwrite="yes" tag. The idea is that it doesn't send me this alerts (as my treshold is set to level 10+), save, restart, but it's completely ignoring it, and I'm stil getting those alerts with level 10 tag.</p>
  
  <p>Frankly, I'm starting to be clueless why is it happening. </p>
  
  <p>Any ideas?</p>
  
  <p>Thanks.</p>