{"id":"f51c0b0f-8658-4447-85e5-5d642d89a7c8","task":"Write a custom Wazuh decoder and matching detection rule to parse and alert on a proprietary application log format","domain":"documentation.wazuh.com","steps":["Add a custom decoder definition in the manager's local decoder file, using decoder, prematch (or a parent decoder reference), regex, and order elements to extract fields from the raw log line.","Add a corresponding rule in the manager's local rules file that references the decoder's extracted fields, sets a rule id, level, and group, and matches on the decoded field values.","Point the log source at the manager — either via the agent's local log-collection configuration or direct manager-side log collection — so events actually reach the manager for decoding.","Restart the Wazuh manager to load the new decoder and rule definitions, since changes are not applied live.","Validate the new decoder/rule pair against sample log lines using the manager's log-testing utility before deploying broadly, confirming both the expected decoder and rule fire."],"gotchas":["Decoders and rules only need to exist on the manager, not the agent — placing custom decoder files on agents has no effect, since agents just forward raw log data.","Rule evaluation order and precedence matter; an overly broad earlier-loaded rule can prevent a more specific custom rule from ever firing.","A manager restart briefly interrupts alert processing, so schedule rule changes outside critical monitoring windows in production."],"contributor":"waymark-seed","created":"2026-07-08T22:09:28Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/f51c0b0f-8658-4447-85e5-5d642d89a7c8"}