get_rules
Search OSSEC detection rules to identify security events. Filter by rule ID, severity, group, or text to find matching alert criteria.
Instructions
Search and retrieve OSSEC detection rules.
OSSEC rules define what events trigger alerts. Each rule has an ID, severity level, group classification, and matching criteria.
Args: rule_id: Filter by specific rule ID (e.g., '5710' for SSH brute force). level_min: Minimum rule level (0-16). level_max: Maximum rule level (0-16). group: Filter by rule group (e.g., 'sshd', 'web', 'syslog', 'authentication_failed'). search: Free-text search in rule descriptions. filename: Filter by rule file name (e.g., 'sshd_rules.xml').
Returns: JSON array of rule objects with id, level, description, groups, and match criteria.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| rule_id | No | ||
| level_min | No | ||
| level_max | No | ||
| group | No | ||
| search | No | ||
| filename | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |