Hi Asmit, Apologies for the delay; I was away on my days off. I've followed up on this internally

Also i noticed this when agent does't move from one manager pr to another. I check files doesn

Thanks, Stuti. That worked like a charm. I appreciate your quick response! On Friday, 24 July 2026 at

You can increase the analysis engine queue following this doc: Wazuh analysis engine queue (queue_and

Hi Stuti, So it seems like restarting the endpoints solves the issue ... The first server on which I

Hi Alex, It is very common while monitoring IIS log files in Windows endpoints. You can run

Hello Himanshu, The issue is resolved now. Sorry, the mistake was on my side. I had applied the

Sorry for the delay in the update. The index template looks good to me. Share the output of these

Hello, FortiGate "reliable" usually means TCP, so that fits with what is being checked.

Hi, 13–15 million events per day is about 150–175 EPS on average, but the real sizing should not be

Hi Asmit, Thanks for the detailed journal output — the timeout kill and the memory figures are a

Hello, The issue is that <match> and <regex> only operate on the log body — they can'

Hello Frederico, The issue is with the extra colon from the log source, Wazuh treats that colon as

Hello, I made sample decoders and rules to help with the logs you shared, the logs were grouped in

Hello MaP, To prevent false alerts from Sysmon, you have three options. Firstly, Sysmon configuration

Hello, Thank you, I'll follow it up there. Best regards, From: 'Olamilekan Abdullateef Ajani

The "Agent key already in use" warning occurs because an agent is trying to register or re-

Hi, Glad this has been resolved, thank you for the feedback. Regards, On Monday, July 20, 2026 at 5:

The group "default" appeared after completing the specified actions. Thanks. понедельник,

Hi doc dodo, I don't see anything wrong in the configuration. I was looking for custom

Hi Aditya, Is your issue resolved, or are you still facing it. On Thursday, July 2, 2026 at 4:42:25

Hi Stuti, good... Right now it is working the sibling decoder. I will be testing . Thanks Regards

Hello, I have an update after checking this internally. This is a known limitation with the alert id

Hi Stuti, Even after changing the script as you tested still not working for me not sure what is the

Hi Unai, You can achieve your use case by making a custom mail integration. Custom integration I will

Hi Max, The main difference is that they relate to different Wazuh components and are used for

Hi, Yes, it is possible to upgrade a Wazuh agent from 4.3.9 to 4.12.0 remotely from the Wazuh

For Windows Server 2022 with Wazuh 4.14.x, those audit‑policy steps are effectively mandatory if the

Hello Vignesh, A key thing to establish first: wazuh-states-vulnerabilities-* is a stateful index,

I would like to share this information here in case anyone needs it. You can use the existing default