DEV Community

#wazuh

Posts

đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.
A single pfSense block never becomes a Wazuh alert. Here is why, measured.

A single pfSense block never becomes a Wazuh alert. Here is why, measured.

Comments
3 min read
Wazuh 5.0 will not load your custom XML rules. 82% of one public pack depends on what it drops.

Wazuh 5.0 will not load your custom XML rules. 82% of one public pack depends on what it drops.

Comments
3 min read
wazuh-analysisd shows at most 50 load warnings. The rest of your ignored rules are silent.

wazuh-analysisd shows at most 50 load warnings. The rest of your ignored rules are silent.

1
Comments
3 min read
Three reasons a custom Wazuh rule stays silent after a clean config check, measured on 4.14.7

Three reasons a custom Wazuh rule stays silent after a clean config check, measured on 4.14.7

Comments
5 min read
Wazuh: 17,587 Fingerprint Matches on the Security Platform Watching Everything

Wazuh: 17,587 Fingerprint Matches on the Security Platform Watching Everything

Comments
3 min read
Wazuh loses events three ways under load, and only one of them raises an alert

Wazuh loses events three ways under load, and only one of them raises an alert

Comments 3
3 min read
One field path, two shapes: how Wazuh alerts get dropped with a 400 nobody sees

One field path, two shapes: how Wazuh alerts get dropped with a 400 nobody sees

Comments
2 min read
Wazuh custom rule never fires, and analysisd -t still exits 0: the file name decides

Wazuh custom rule never fires, and analysisd -t still exits 0: the file name decides

1
Comments
3 min read
Wazuh ms-graph: why Entra ID sign-ins never reach the indexer, and a one-processor fix

Wazuh ms-graph: why Entra ID sign-ins never reach the indexer, and a one-processor fix

1
Comments
7 min read
Two coverage zeros, two different causes

Two coverage zeros, two different causes

Comments
3 min read
From Setup to Signal: Building My First Wazuh SIEM with Sysmon and Atomic Red Team

From Setup to Signal: Building My First Wazuh SIEM with Sysmon and Atomic Red Team

Comments
9 min read
Your SIEM has never been asked a question it could fail

Your SIEM has never been asked a question it could fail

Comments
2 min read
A rule that is present, enabled, and silent: what Wazuh 92900 shows about coverage reports

A rule that is present, enabled, and silent: what Wazuh 92900 shows about coverage reports

Comments
2 min read
We replayed 24 ATT&CK techniques against a default Wazuh install. Three raised an alert.

We replayed 24 ATT&CK techniques against a default Wazuh install. Three raised an alert.

Comments
4 min read
Deploying and Validating a Wazuh SIEM with Atomic Red Team

Deploying and Validating a Wazuh SIEM with Atomic Red Team

Comments
8 min read
đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.