Custom rule with Predecoded fields

[Mithun Haridas]

Hi Team,

I am currently working on a use case related to login activities and encountered an issue while creating a custom rule.

My objective was to write rules for specific firewalls, so I decided to use the hostname available in the full log as a match condition. However, I am not getting the expected result.

Sample Log:

Jul 20 07:57:13 ABCDEF.Firewall.com notice httpd[16489]: 0650911:5: AUDIT - user xyz - RAW: httpd(mod_auth_pam): user=xyz(xyz) partition=[All] level=Administrator tty=/bin/bash host=00.0.00.000 attempts=Mon Jul 20 07:57:13 2026".

This is an F5 BIG-IP log. The event is matching the parent rule even though I configured the following child rule with a hostname match condition.

Existing Rules:

<rule id="110907" level="10">

<if_sid>65298</if_sid>

<field name="event.code">01070417</field>

<field name="start_time">\.+</field>

<description>F5 BigIP: User session started.</description>

</rule>

<rule id="110909" level="10">

<if_sid>65299</if_sid>

<field name="event.code">01070417</field>

<field name="start_time">\.+</field>

<description>F5 BigIP: User session started.</description>

</rule>

New Rule:

<rule id="110939" level="11">

<if_sid>110907,110909</if_sid>

<match>ABCDEF.Firewall.com</match>

<description>F5 BigIP: User session started in ABC region.</description>

</rule>

When testing, the event matches rule 110909 and does not trigger rule 110939.

Could anyone help me understand why the hostname match condition is not working as expected, or suggest a better way to match events from this specific firewall?

Thanks in advance.

[Brenno Garcia]

Hello,

The issue is that <match> and <regex> only operate on the log body — they can't see the syslog header. During pre-decoding, Wazuh strips the timestamp and hostname from the log and stores them as separate fields (predecoder.timestamp and predecoder.hostname), so they're never exposed to the body-matching conditions.

Given this log:

Jul 20 07:57:13 ABCDEF.Firewall.com notice httpd[16489]: 0650911:5: AUDIT - user xyz - RAW: httpd(mod_auth_pam): user=xyz(xyz) partition=[All] level=Administrator tty=/bin/bash host=00.0.00.000 attempts=Mon Jul 20 07:57:13 2026

Pre-decoding extracts:

• timestamp: Jul 20 07:57:13
• hostname: ABCDEF.Firewall.com

And only the remainder is visible to <match>/<regex>:

notice httpd[16489]: 0650911:5: AUDIT - user xyz - RAW: httpd(mod_auth_pam): user=xyz(xyz) partition=[All] level=Administrator tty=/bin/bash host=00.0.00.000 attempts=Mon Jul 20 07:57:13 2026

Wazuh provides a dedicated <hostname> tag that matches directly against the pre-decoded hostname field. This is the cleanest approach and avoids any workaround:  

<hostname>ABCDEF.Firewall.com</hostname>

https://documentation.wazuh.com/current/user-manual/ruleset/ruleset-xml-syntax/rules.html

Best regards,