Hi @Akai,
I am also a new user of Suricata, but this post may help you (please see in the thread the message from a Suricata team member).
When using Evebox to view events and alerts, it is also visible that the severity level 2 is higher than severity level 3, hence we can guess what about severity level 1 