Infra Notes

Wazuh custom rule not triggering: test with real log samples first

Before changing rule logic repeatedly, test custom rules with real log samples and confirm the matched decoder or base rule.

WazuhWazuhRulesDecoderTestingSIEM

Problem

A custom Wazuh rule is deployed, but no alert is generated.

Why it happens

The incoming log may not match the expected decoder, field, base rule ID, or pattern.

Fix / Approach

Start with a real log sample, run it through logtest, confirm the decoder and base rule, then build the custom rule from there.

Command / Config

Useful checks:

  • `/var/ossec/bin/wazuh-logtest`
  • `/var/ossec/logs/alerts/alerts.json`
  • matched decoder
  • matched `rule.id`
  • field names in the event

When to use

  • Suppression rules
  • Custom detections
  • ClamAV or YARA rules
  • Application logs
  • Wazuh tuning

When not to use

  • When the log is not collected by the agent at all