I would like to change the severity of a system rule from yellow to red. After investigating it doesn't look like the system rules can be changed. So my thought was to copy this rule to a user rule and inactivate the system rule. Is this the best way to go about this?
Also, does anyone know the order in which rules are processed? Are system rules looked at first then user? Is it based on first match? I couldn't find anything on Cisco's website discussing this.