Wazuh rule

<rule id="100000" level="10">...</rule>

Create a custom rule in Wazuh (local_rules.xml) that detects a specific event or pattern with its severity and MITRE group.

Use it when Wazuh's default rules don't cover an event you care about: the custom rule in local_rules.xml defines the match (event fields, decoders), severity (level), description, and group (including MITRE tags for the dashboard). It's the standard mechanism to adapt Wazuh to your environment: detect an event from a specific application, fine-tune a generic rule that generates noise, or add the ATT&CK technique to an existing detection. The flow: write the rule, test it with wazuh-logtest using a real event, and reload the manager — the detection becomes operational without touching the rest of the ruleset.

Don't create it without testing with wazuh-logtest: a rule with the decoder or fields incorrectly referenced never fires (or always fires) — testing with a real event is mandatory before deploying. Rule order matters: the custom rule must go in local_rules.xml (evaluated after the base ruleset) and use if_sid to chain — a poorly chained rule can end up dead or override existing ones. And watch the level: a level 10 for something that happens often generates noise that ends up silencing the dashboard; severity is calibrated with the event context, not by default.