Test Wazuh rule on a real manager
test_wazuh_ruleRead-onlyIdempotent
Runs log lines through a real wazuh-manager 4.14.9 (fresh logtest session) with your custom rules and decoders: which decoder and rule matched, whether YOUR rule fired, and load warnings such as 7617/7619. Logtest engine: frequency/timeframe rules and some live-only behaviour are out of scope. Free: 1 log line with your files (3 with the stock ruleset only), summary. 10 lines with decoded fields and full alerts: POST https://atkvn.com/agent/v1/wazuh-testfire (x402, USD 0.10).
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| logs | Yes | Raw log lines exactly as the agent would forward them, one event per item. | |
| rules | No | Optional custom rule files: [{"filename": "0096-local.xml", "xml": "<group>...</group>"}]. Filename order matters: files load by name together with the stock ruleset. | |
| decoders | No | Optional custom decoder files, same shape as rules. | |
| log_format | No | Wazuh log_format, e.g. syslog or json. | syslog |