Opened it with the logtest output and your 4.14.8 case: https://github.com/wazuh/wazuh/issues/39767

Because as in previous version, you can not install wazuh agent on wazuh manager. And Wazuh manager

Hextra Srl Thanks for sharing the processor. We tested it as is against real auditd events from our

Hello, The decoder is the inbuilt JSON decoder so you do not need to do anything. As mentioned, after

Hi Peter! This is a well-known false positive caused by Btrfs, not a rootkit. Rootcheck's "

Hello Bob! I was able to reproduce the same error in my Lab. It seems that in the recent version, the

You are right, and it holds for 4.4.5 too. I checked ruleset/rules/0350-amazon_rules.xml at v4.4.5,

A follow-up on case 3, because the part I left open now has a measurement behind it. Francisco Sousa

Hextra, the loop is not closed yet, it moved. The two lines you quoted come from two different

Hello, Yes, that is most likely what happened. Ubuntu kernel packages usually includes the kernel

Hi, After completely deleting the integration and using your decoders, I initially ignored the

Hello! What kind of edit or modification are you trying to make to the threat hunting dashboard? If

Hello Carlos This is the Vulnerability Detection and indexer configuration from one of workers nodes

Hello Arun, For Wazuh, there is no fixed CPU/RAM to EPS ratio, because the cost of processing an

Hi Arun, There's no confirmed 4.14.x bug I know of where not_match_key fails on one occasion and

Hello, I am glad it has been fixed. The correction has reached your scanner, and the update has been

curl -s https://cti.wazuh.com/api/v1/catalog/contexts/vd_1.0.0/consumers/vd_4.8.0 | jq '.data | {

Hello, Thank you for the detailed description and screenshots, helps isolate the issue. - For

Francisco, I'm taking the three-state split as a correction, and it changes what I publish rather

Hi again! Can you check if the reported package is installed in your system? The path should be

Hi, Thank you for bringing this to our attention. The false positive has already been reported.

Looks like it's been fixed. Olamilekan Abdullateef Ajani schrieb am Mittwoch, 16. September 2026

You cannot configure this in the Wazuh configuration. You can delete the archive files using a cron

Hi Harishwar, First, to be sure I am solving the right problem: do you want your existing Django

Hello Jack, There is no fixed Wazuh limit of 1000 indices. The number 1000 refers to the open shard

Hello Changing the port from 514 to 6514 is not enough, as that would only create a plain TCP

Hi Harishwar, I believe this is not a Wazuh 4.14.7 bug. The empty [] in the error means the plugin

Awwal - the technique list and the replay harness are public: https://github.com/xuxu298/siem-replay-

Hello, Could you clarify what you mean by monitoring the APIs? Are you looking to: Collect and

Hi, It seems the CTI is now up2date and the system runs as expected :) thank you all. Le lundi 14