I’am trying to modify a rule into 0015-ossec_rules.xml

<rule id="10550" level="10">
<if_sid>550</if_sid>
<regex>/home/.*/.ssh/</regex>
<description>Integrity checksum changed in /home/*/.ssh/</description>
</rule>

but when i do a modification on the .ssh of any user the rule alert coming from

<rule id="550" level="7">
<category>ossec</category>
<decoded_as>syscheck_integrity_changed</decoded_as>
<description>Integrity checksum changed.</description>
<mitre>
  <id>T1565.001</id>
</mitre>
<group>syscheck,syscheck_entry_modified,syscheck_file,pci_dss_11.5,gpg13_4.11,gdpr_II_5.1.f,hipaa_164.312.c>
</rule>

any ideas? thank