rule id 61102 dublications

9 views
Skip to first unread message

artem frolov

unread,
7:04 AM (5 hours ago) 7:04 AM
to Wazuh | Mailing List
Hello, can u clarify some strange things with rule 61102. When i get csv file with all events (data.win.system.eventID: Descending;  rule.level: Descending; rule.description: Descending; rule.id: Descending; Count), i found that standard rule 61102 have dublicate. I understand that this rule haven't event id, but why generate so much IDs?

Screenshot 2025-10-10 125337.png
Reply all
Reply to author
Forward
0 new messages