Wazuh | Mailing List

Hi, Wazuh FIM DB does not store old data for files that have already been removed. When a monitored

Hi Adrian, - Wazuh version you are using. wazuh-agent-4.14.4-1.x86_64 (both server and agent) -

Hi, I understand your requirement. To reduce the index size, the main approach is to fine-tune the

Hi Community, I have currently Wazuh All-in-One Deployment, and would like to separate the indexer

Hi Mithun, At the moment, Wazuh rules do not natively support direct field-to-field comparison inside

Hi, It seems you created another custom child rule for the vulnerability alerts, and that custom rule

Hi Nick You can configure mail alerts with a custom integration script, and you can modify the custom

Hi Brenno, Use this configuration instead of my previous message, I tested it locally and worked fine

Hi M Jones, there's a small mistake on the custom rule I sent you as an example. The fields don

Hi, There are no log entries present in /var/ossec/logs/alerts/alerts.json on the associated manager.

Hi MG, Realtime monitoring applies to both directories and files. For directories, it monitors all

Hi @ Musbau Adekunle Soladoye Help me with the information on my previous query .. On Tuesday, April

Hi bastian Caro Regarding your environment, can you tell me which version of Wazuh you're using?

Hello Spartan, Best way to do this is to filter from the Discover dashboard using the agent ID and

what is the proper way of changing wazuh dashboard password for multi node deployment?

Hello! Please review while mapping the user with the Wazuh API, you have given the correct permission

Update: Your destination alerts index will look like "dest": { "index": "

Hello Daniel, Good news, we checked the wazuh-indexer index directly and the vulnerability data for

Dear Md. Nazmur Sakib, I tried the decoder and ruleset you sent me, and when I applied them, an alert

Hi Aamir, There are no vulnerability alert triggers for the initial or baseline vulnerability scan.

Hi Brenno Try adding both use_own_name and a specific prematch to that child decoder: <decoder

In Wazuh, “logs” can refer to different data sources (agent logs, alerts, or events stored in the

Hi, Carlos I think is will help me: <syscheck> <disabled>no</disabled> <

Hi Diego, I was able to fix the issue. Again, it was simple permissions issue. Another problem I

Hi team, On Debian Trixie. /usr/bin/chsh /bin/passwd /usr/bin/passwd /usr/bin/chsh Is there a more

Hello! To achieve this, you need to modify the existing default decoders with the custom decoders. To

Hi , This is okay already, we created new wazuh instance and then migrated all data to it On

When it is possible to increase the shard limit, it is not advisable to increase the number too high

Hi, Apologies for the late response. From the shared manager log, it seems you have two issues. One

For that dashboard, it wont be possible to drill down. On Tuesday, April 21, 2026 at 5:23:28 PM UTC+1