# Severity vs signature\_severity

**URL:** <https://forum.suricata.io/t/severity-vs-signature-severity/5263>\
**Category:** Rules\
**Tags:** rules, suricata\
**Created:** [January 21, 2025, 8:27am UTC](https://forum.suricata.io/t/severity-vs-signature-severity/5263 "2025-01-21T08:27:37Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![pevma](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/pevma/32/29_2.png) [@pevma](https://forum.suricata.io/u/pevma)\
**Post date:** [January 21, 2025, 9:26am UTC](https://forum.suricata.io/t/severity-vs-signature-severity/5263/2 "2025-01-21T09:26:24Z")

</div>

Both severities can be set up by the rule writer (by default it is 1).  
ref: [Suricata alert severity levels and how to verify that the maximum level that can be triggered by a test custom rule](https://forum.suricata.io/t/suricata-alert-severity-levels-and-how-to-verify-that-the-maximum-level-that-can-be-triggered-by-a-test-custom-rule/1443)

There is also `signature_severity` that is defined in the metadata section of the rule , it has no impact on detection - it is just for information.

```auto
....metadata:created_at 2021_05_04, signature_severity Minor, updated_at 2025_03_13;.....

```

---

_[View the full topic](https://forum.suricata.io/t/severity-vs-signature-severity/5263)._