Hello Sakib, The containers were all stopped while this operation was done. There are indeed two <

Brenno, sorry for the long delay... It turns out my solution was simpler: 1. I set up my network

Hello Ali, I looked through the thread, and based on the latest debug message: Unable to add

Hi Max, I run a 400+ agent cluster (one master, multiple workers), so your question hits close to

@Bony V John Thanks for the information. Could you please provide the guidelines or rules to follow

Hi Sachin, Configure the script to write each collected event to a log file, for example: /var/log/

Hello Jack, Yes, a read-only user can be restricted from modifying rules. The one thing to note is

Hello, Just to update you, I did further digging and found out Canonical has changed the public_date

Hi Max, Thanks for the detailed information and screenshots. What you are seeing is expected, and

Hi Asmit, There is no native Wazuh integration for Cloudflare R2 buckets like there is for some AWS

Hello, For the JSON_Decoder plugin you can't restrict which keys it parses, exclude fields, or

Hello, Thanks for the output. This confirms the issue is not the saved search itself. The object

Hello Marcos, Indeed, I checked again and it appears that the resource type *:* is more the problem

Good afternoon, Thank you very much for the initial information. Please, when you have any further

Hi CRIZ, Currently, you cannot create a child decoder under syscheck_integrity_changed. That decoder

Hi Bayu, The error you're encountering is related to the timestamp format. The Wazuh Indexer is

The syslog/port/listener side is a standard Wazuh setup regardless of vendor. The guide covers it

Hi George, Apologies for the delay. If you change the decoder name, it may affect the child decoders

Hi, This is working fine for me, and with just a sample, it is difficult to understand. Can you

Hi Soc Support I am glad that your issue has been resolved. Let us know if you need further

Hello Jack, I checked this further on a Wazuh 5.0 instance, and I need to clarify one thing. Event ID

Hello CRTZ, FIM monitors file system changes to detect the creation, modification, and deletion of

Hi Chukwudalu Chisimdi Okonkwo, Thanks for your support Regards, On Tuesday, August 4, 2026 at 2:52:

Thank you for the detailed information and the screenshots — that helped us confirm the cause. This

Hello Kamran, I have reviewed your Windows agent.conf file and here are a couple that will help you

What kind of custom configuration you would like to do will depend on what type of logs you want to

Hello. There is indeed a limit on the event size, but it's not the limit that's causing your

Hi, Thank you for your valuable response. I will try the methods you mentioned above and will get

Hello Jack, At the moment, Wazuh 5 is still in beta, not a stable production release. The latest

Hello, When I said export/save important config files, I took the reference from the Wazuh back up