Hi everyone, Filebeat logs events being rejected for data.office365.ModifiedProperties. The same

Hi Mazar, By default, Wazuh detects and analyzes potential malware and generates alerts, but it does

Hi, We are currently reviewing the software lifecycle requirements for our Wazuh deployment. We found

Hello Uni, Thanks for the clarification regarding the role export. You don't need to delete the

Add this to /var/ossec/etc/local_internal_options.conf, then restart the manager: wazuh_modules.debug

Hextra, the restart is the clue, and it reproduces. First the lines: 4.14.8 did not touch the feed

Hi Nguyen! As far as I can tell, there is no supported way in 5.0.0-rc1 to express a 4.x frequency/

Some numbers that might help with the DLS route Kevin suggested. On 5.0.0-rc1, in a test container, I

Hello Stefan, One additional place to check is the package synchronization state in Wazuh-DB on the

Yes, you can create a child decoder with json as its parent. There's one thing to watch out for,

Okay got it. Thanks for the help and support. Will provide further details later. On Wednesday,

I have escalated this to the team responsible for updating the feed. They will review this further

Hi again! We could check this internally and confirmed this is a false positive. The corresponding

Matteo, Same root cause as data.data, and I would fix it in the same place: a template. A pipeline

Hi, You can isolate endpoints automatically with Wazuh using these approaches: 1. Active Response:

Hi Nazmur, I am currently still having issues with the detectors and cannot find the cause. I have

That error comes from the vulnerability scanner's re-scan step, not from the indexer connection.

This looks like a race in the CDB lookup, not your list. We reproduced it on 4.14.7 with your rule

Adam, I tested this on 4.14.7 and it's what analysisd does for anything that comes in through an

Because as in previous version, you can not install wazuh agent on wazuh manager. And Wazuh manager

Hextra Srl Thanks for sharing the processor. We tested it as is against real auditd events from our

Hello, The decoder is the inbuilt JSON decoder so you do not need to do anything. As mentioned, after

Hi Peter! This is a well-known false positive caused by Btrfs, not a rootkit. Rootcheck's "

Hello Bob! I was able to reproduce the same error in my Lab. It seems that in the recent version, the

You are right, and it holds for 4.4.5 too. I checked ruleset/rules/0350-amazon_rules.xml at v4.4.5,

A follow-up on case 3, because the part I left open now has a measurement behind it. Francisco Sousa

Hello, Yes, that is most likely what happened. Ubuntu kernel packages usually includes the kernel

Hello! What kind of edit or modification are you trying to make to the threat hunting dashboard? If

Hello Arun, For Wazuh, there is no fixed CPU/RAM to EPS ratio, because the cost of processing an

Hello, I am glad it has been fixed. The correction has reached your scanner, and the update has been