Hextra, your debug run answers the half it was built to answer, and I went and measured the other

Hello, I am glad it has been fixed. The correction has reached your scanner, and the update has been

That settles the precondition, and it moves the retroactive count from something that has to be

Hello Varun, Please when responding on Google Group, please be sure to use the reply-all so it comes

curl -s https://cti.wazuh.com/api/v1/catalog/contexts/vd_1.0.0/consumers/vd_4.8.0 | jq '.data | {

Hello, Thank you for the detailed description and screenshots, helps isolate the issue. - For

Francisco, I'm taking the three-state split as a correction, and it changes what I publish rather

Hi all, I'm running Wazuh 4.14.7 via the official wazuh-docker single-node compose setup (manager

Hi again! Can you check if the reported package is installed in your system? The path should be

Hi, Thank you for bringing this to our attention. The false positive has already been reported.

Looks like it's been fixed. Olamilekan Abdullateef Ajani schrieb am Mittwoch, 16. September 2026

You cannot configure this in the Wazuh configuration. You can delete the archive files using a cron

Hi Harishwar, First, to be sure I am solving the right problem: do you want your existing Django

Hello Jack, There is no fixed Wazuh limit of 1000 indices. The number 1000 refers to the open shard

Hello Changing the port from 514 to 6514 is not enough, as that would only create a plain TCP

Hi Harishwar, I believe this is not a Wazuh 4.14.7 bug. The empty [] in the error means the plugin

Awwal - the technique list and the replay harness are public: https://github.com/xuxu298/siem-replay-

Hello, Could you clarify what you mean by monitoring the APIs? Are you looking to: Collect and

Hi, It seems the CTI is now up2date and the system runs as expected :) thank you all. Le lundi 14

1. Relating to my previous responses: define `wazuh_modules.debug=2` in the `/var/ossec/etc/

Hi Anastasia, I believe you are talking about network devices like Checkpoint firewall. You have two

Hi Stefanny, Based on my research, Darktrace can send syslog alerts (cef, leef, json).

Hi Hari, Thanks for confirming the version. Let's narrow down whether this is a data problem (the

I believe I know why this is happening ( I have a decoder with a rule that in logtest gives me what I

The record format works as you describe, and I'll put the restart condition into the procedure

Hello Klein, Thank you for sharing this. But think this PR will not be merged, as there is no

Those two lines aren't the same field, and for 4688 only one of them lives in EventData. The

You can check this document for a similar use case. Monitoring Windows resources with Performance

Hello, When integrating network devices like a FortiGate firewall, the better approach is to use a

Hi Raju! You will find vulnerability information in two types of indices. wazuh-states-