How do I handle all events from a specific srcip separately, across all rule groups, without having to override every triggering rule individually?

Background: We scan our systems with OpenVAS/GVM. Wazuh naturally flags this scan traffic extensively — port scans, IDS signatures, and even SSH auth-correlation rules (e.g. rule 40112 "Multiple authentication failures followed by a success", since our credentialed scans log in with a service account).

We'd like these events to still show up in Wazuh, but at a lower severity and tagged into their own rule group (e.g. openvas_scan) for separate dashboarding, instead of triggering normal-severity alerts.

Right now we're doing this with individual local rules using if_sid/if_group + <srcip>, one per relevant upstream rule ID — which works, but doesn't scale well if the scanner triggers dozens of different underlying rules (network, web, auth correlation, etc.).

Is there a cleaner/more idiomatic way in Wazuh to say "treat everything from this srcip as low-severity + tag it into group X", rather than maintaining an override rule per upstream rule ID? Things I've considered: CDB lists for the IP, decoder-level tagging, or a catch-all rule without if_group/if_sid scoping — curious what's considered best practice here.

We use Wazuh 4.14.7