WAZUH/OSSEC - overwriting rules doesn't seem to work

I'm trying to overwrite a rule as per documentation, like this

https://documentation.wazuh.com/3.12/learning-wazuh/replace-stock-rule.html

So I've copied one rule to local_rules.xml, created my own group (prior to that also tried to put it within the rule's original group tag), but it seems to be completely ignoring it:

This is what I've put in local_rules.xml:

<group name="istvan">
    <rule frequency="8" id="31533" level="9" overwrite="yes" timeframe="20">
        <if_matched_sid>31530</if_matched_sid>
        <same_source_ip/>
        <description>High amount of POST requests in a small period of time (likely bot).</description>
        <group>pci_dss_6.5,pci_dss_11.4,gdpr_IV_35.7.d,nist_800_53_SA.11,nist_800_53_SI.4,</group>
    </rule>
</group>

I've only changed the level to 9 and added the overwrite="yes" tag. The idea is that it doesn't send me this alerts (as my treshold is set to level 10+), save, restart, but it's completely ignoring it, and I'm stil getting those alerts with level 10 tag.

Frankly, I'm starting to be clueless why is it happening.

Any ideas?

Thanks.

Solution

After finally talking to the developers, it turns out that it was indeed ignoring local_rules.xml. I had a strage exclusion of one rule (probably a problematic syntax, although it did't report an error)

      "rule_exclude": [
     "31151"

When I removed it, it started working as described in the user's guide.