Audit Wazuh custom rules
audit_wazuh_rulesRead-onlyIdempotent
Finds Wazuh custom rules that pass wazuh-analysisd -t but are dropped at load (load order across ruleset/rules and etc/rules, missing parents, duplicate or colliding ids). Input: list of {filename, xml}. Supported versions: 4.14.7, 4.14.9. Free: counts + 2 findings. Full report: pass api_key.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| files | Yes | Custom rule files, each {"filename": "0094-local.xml", "xml": "<group>...</group>"}; filename exactly as in /var/ossec/etc/rules/, up to 20 files. | |
| api_key | No | Optional key for the full report. Without it you get counts and 2 findings; the full report is also sold per call by x402 at POST https://atkvn.com/agent/v1/wazuh-audit. | |
| wazuh_version | No | Wazuh manager version: 4.14.7 or 4.14.9. | 4.14.9 |