Both severities can be set up by the rule writer (by default it is 1).
ref: Suricata alert severity levels and how to verify that the maximum level that can be triggered by a test custom rule
There is also signature_severity that is defined in the metadata section of the rule , it has no impact on detection - it is just for information.
....metadata:created_at 2021_05_04, signature_severity Minor, updated_at 2025_03_13;.....