Rules not showing in Wazuh dashboard

[Amit Eilat]

Hi All,

I have 2 questions regarding the Wazuh dashboard:

1. we have Filebeat to transfer data from the Manager and Workers to the Indexer, and they're displayed on the Wazuh dashboard. We see the data and can also use the management tabs.
We have an unexplained error on the Rules files not showing in the dashboard...
Everything else is there - decoders, groups... - but not the Rules. There are 2 popups that say
Error: Error searching items
3013 - Wazuh Internal Error
and
TypeError: Error fetching items
Cannot read properties of undefined (reading 'items')

2. A more general question - we are very new for the indexer and the dashboard platform, and we can't seem to find ANY documentation or walkthrough that can explain the MANY MANY capabilities and features of the dashboard. We're getting tired of guessing what everything new we encounter means. We'd be super thankful for anything or anyone that would be able to help

Thank you,
Amit

[Luis Enrique Chico Capistrano]

Hello Amit, 

Thank you for reaching out with your questions about Wazuh.

Regarding the error you're encountering with the Rules files not showing in the dashboard, it's crucial to diagnose the issue accurately. Could you please provide more details about your Wazuh setup? Specifically, what version of Wazuh are you currently using, and is your deployment centralized or distributed?

Additionally, I've requested some log files from your environment to help pinpoint the issue. 

• cat /var/log/wazuh-indexer/wazuh-cluster.log | grep -n5 -i -E "error|warn" > indexer.txt
• cat /var/log/filebeat/filebeat | grep -n5 -i -E "error|warn" > filebeat.txt
• cat /var/ossec/logs/ossec.log | grep -n5 -i -E "error|warn" > ossec.txt
• cat /usr/share/wazuh-dashboard/data/wazuh/logs/wazuhapp.log | grep -n5 -i -E "error|warn" > dashboard.txt

 
Please run the provided commands and share the contents of the generated text files (indexer.txt, filebeat.txt, ossec.txt, and dashboard.txt). These logs should give us valuable insight into any errors or warnings occurring within the system, which will aid in troubleshooting the problem.

As for your second question about documentation and walkthroughs for the Wazuh dashboard, I understand the importance of having comprehensive resources to guide you through the platform's capabilities. I've provided some links below that you might find helpful in exploring the features of the Wazuh dashboard:

• Wazuh indexer
  
• Wazuh dashboard

These resources should provide detailed information on setting up, configuring, and utilizing various features of both the indexer and the dashboard. If you have any specific questions or need further assistance, don't hesitate to ask. We're here to help you navigate through your Wazuh deployment.

Looking forward to hearing back from you with the log files and any additional information about your setup.

Best,
Luis