r/Wazuh

Hi!
I'm currently testing wazuh FIM for auditing our win2019 fileserver and ran into unexpected behaviour. The folder I want to monitor contains about 50:50 binary files and text files. I've enabled report_changes. Obviously this only makes sense for text files, so I excluded the binary file extensions via regex. All files are roughly the same size, so a size filter won't work.

The dashboard shows "diff truncated due to nodiff" for the binary files which is expected, but the excluded files are still copied to queue\diff\file.
Not only does this take up space, it also puts unneccesary load on the system. Is there any way to stop wazuh from copying excluded files?

server & agent 14.14.7

The version im using is v4.12.0

Both of the rule are for a Window 10 agent on vmware workstation, they are just for testing and not on real system if you know what i mean.

The first rule is to send an alert after some failed login attemps, this is my version:

<rule id="100002" level="15" frequency="3" timeframe="120">

<if_matched_sid>60122</if_matched_sid>

<same_field>win.evendata.ipAddress</same_field>

<description>Multiple failed login attemps in 2 minutes</description>

</rule>

and when I test the rule by going to lock screen and enter incorrect password multiple times, the rule work just fine.

But the second rule (let call it 100003), which is to check if 10 second after the 100002 rule was alerted, if there are success login attemp then if will fire with something like "Login successfully after multiple failed attemps"

The rule id for success login is 60118

How do I write the second rule, please help me

I'm having trouble upgrading a Wazuh agent through the Wazuh Dashboard and I'm trying to figure out what is causing the failure.

The Wazuh manager is on the latest version 4.14.7, however the agent is on verson 4.12.0.

When I try to upgrade it through the dashboard, the upgrade process is created, however after a minute i get the error:

Status: Failed

Error: Send write file error

I also tested connectivity from the network and the agent is active and communicating, so 1514 connectivity appears to be working.

Is there a way to fix the error and perform the upgrade through the Dashboard/API without needing to remotely access the endpoint through AnyDesk?

Thank you.

https://preview.redd.it/nmyzj3kxswjh1.png?width=1657&format=png&auto=webp&s=78dc7e898a8ce93a9e1e09b9a7eefeba97c5e6c5

Relatively new to Wazuh. Setting up a PoC.

I followed the directions for setting up a Wazuh manager to listen on syslog.

It isn’t able to start the listener on port 514 (tcp or udp). It errors with “Transport endpoint is not connected.”

I confirmed nothing was listening on the port with netstat

If I run netcat, I can set up a listener, and it receives the syslogs.

I tried other ports as well, same error. Searching only found an issue with the client that was fixed by an upgrade, but I downloaded the system within the last week.

Any ideas?

How do I handle all events from a specific srcip separately, across all rule groups, without having to override every triggering rule individually?

Background: We scan our systems with OpenVAS/GVM. Wazuh naturally flags this scan traffic extensively — port scans, IDS signatures, and even SSH auth-correlation rules (e.g. rule 40112 "Multiple authentication failures followed by a success", since our credentialed scans log in with a service account).

We'd like these events to still show up in Wazuh, but at a lower severity and tagged into their own rule group (e.g. openvas_scan) for separate dashboarding, instead of triggering normal-severity alerts.

Right now we're doing this with individual local rules using if_sid/if_group + <srcip>, one per relevant upstream rule ID — which works, but doesn't scale well if the scanner triggers dozens of different underlying rules (network, web, auth correlation, etc.).

Is there a cleaner/more idiomatic way in Wazuh to say "treat everything from this srcip as low-severity + tag it into group X", rather than maintaining an override rule per upstream rule ID? Things I've considered: CDB lists for the IP, decoder-level tagging, or a catch-all rule without if_group/if_sid scoping — curious what's considered best practice here.

We use Wazuh 4.14.7

Greatings.

I'm deploying Wazuh on my lab environment trying to see if it matches my needs as I want to build a small SOC. As I have been playing with it, one question arose: I can monitor whatever is on the same network of my Wazuh, and different subnets or VLANs as long as my firewall allows traffic , but what about endpoints on remote locations?

Reading some old posts, I've seen that VPN or tunnelization is a possibility given that I would only monitor devices that are not BYOD or those which connects through a VPN to internal resources.

My question is now what follows:

https://preview.redd.it/rhdjit7v4djh1.png?width=1547&format=png&auto=webp&s=4d4610e8dd2f590af7c3641ef0f78422f1802be2

Looking at the clearly 5 yo kid drawing, the logs would be tunnelized through an IPsec connection between both firewalls. If I show the network or the sole IP of the Wazuh server to the tunnel, the agents deployed in each endpoint may have configured the private IP of the Wazuh server or any configuration should be done?

2nd scenario: say I cant make a s2s IPsec tunnel for whatever reason and the client don't want to use VPN against me since they already have their own but still want to feed logs to my wazuh. Is possible to make something like CheckMK and install a "satellite" Wazuh which collects logs from the endpoints and then feeds them through VPN against my FW? Would I lose information if this method is used?

Thanks beforehand!

Hey guys, I manage a large size organization Wazuh, and I have been getting thousands of alerts regarding outdated Firefox version's CVEs spread around my company, since I have hundreds of machines, this is just trash alerts for me, and I would like to find a way to reduce their threat level from 13 to, for example, 5.

Is there any way I can get all alerts that fit the following description:

data.vulnerability.package.name: Mozilla Firefox (x64 pt-BR)

To be lowered down to level 5?

I tried many rules in local_rules, all of them generated by AI, but none of them seem to work

Hi everyone,

I'm running a 3-node Wazuh indexer cluster. When I shut down one indexer node, the OpenSearch cluster stays healthy (green/yellow) and the API responds fine via curl from the remaining nodes. However, the Wazuh Dashboard completely crashes with a `securityDashboard` plugin error (setup lifecycle failure / Request Timeout after 30000ms).

All three indexer IPs are listed in `opensearch.hosts` in `opensearch_dashboards.yml`. If I comment out the dead node's IP, the dashboard starts fine — but obviously that defeats the purpose of HA.

I also noticed this matches the open bug opensearch-project/OpenSearch-Dashboards#9825.

My questions:

- Has anyone found a native dashboard parameter to handle this gracefully?

- Is putting an Nginx reverse proxy in front of the indexers the only real workaround?

- Any ETA on a fix from the Wazuh/OpenSearch side?

Hi Wazuh Community,

We have enabled the following settings on our Wazuh Manager:

<logall>yes</logall>g
<logall_json>yes</logall_json>

We also enabled archive forwarding in Filebeat:

archives:
  enabled: true

As I understand it, all events are stored locally on the Wazuh Manager under /var/ossec/logs/archives/, and Filebeat also sends the archive events to the Wazuh Indexer as wazuh-archives-*.

Our concern is that the archive files on the Manager can grow very quickly and eventually fill the Manager disk.

What is the recommended way to optimize this setup?

1. Can we keep only a short retention period (for example, 7 days) for archive files on the Wazuh Manager after confirming they have been successfully indexed?
2. Can the Wazuh Indexer be used as the main long-term storage for wazuh-archives-*?
3. What is the recommended method to automatically clean up old archive files on the Manager without affecting Filebeat or losing events?
4. What is the recommended retention method for wazuh-archives-* on the Indexer to prevent the Indexer disk from becoming full as well?

We want to keep archive collection enabled while preventing both the Manager and Indexer storage from filling up.

Thank you.