[ossec-list] Editing alert-level on existing rules

[frankstefan]

Hi.

I want to edit the alert-level for Multiple failed sshd-logins. Do I
edit sshd_rules.xml or cut and paste it  to local_rules.xml in order
to not overwrite it the next time i update?