get_rule

Instructions

Implementation Reference

• src/tools/rules.ts:90-152 (registration)

  Registration of the 'get_rule' tool on the MCP server via server.tool(), with name 'get_rule', description 'Get detailed information about a specific Wazuh rule by ID', and zod schema for the rule_id parameter.

  server.tool(
    "get_rule",
    "Get detailed information about a specific Wazuh rule by ID",
    {
      rule_id: z
        .number()
        .int()
        .describe("Rule identifier (e.g., 5710)"),
    },
    async ({ rule_id }) => {
      try {
        const response = await client.getRule(rule_id);
        const rules = response.data.affected_items;
  
        if (rules.length === 0) {
          return {
            content: [
              {
                type: "text" as const,
                text: JSON.stringify({ error: `Rule '${rule_id}' not found` }),
              },
            ],
            isError: true,
          };
        }
  
        const rule = rules[0];
        const result = {
          id: rule.id,
          description: rule.description,
          level: rule.level,
          groups: rule.groups,
          filename: rule.filename,
          relative_dirname: rule.relative_dirname,
          status: rule.status,
          pci_dss: rule.pci_dss,
          gdpr: rule.gdpr,
          gpg13: rule.gpg13,
          hipaa: rule.hipaa,
          nist_800_53: rule.nist_800_53,
          tsc: rule.tsc,
          mitre: rule.mitre,
          details: rule.details,
        };
  
        return {
          content: [{ type: "text" as const, text: JSON.stringify(result, null, 2) }],
        };
      } catch (error) {
        return {
          content: [
            {
              type: "text" as const,
              text: JSON.stringify({
                error: error instanceof Error ? error.message : String(error),
              }),
            },
          ],
          isError: true,
        };
      }
    }
  );

• src/tools/rules.ts:99-151 (handler)

  Handler function for 'get_rule': calls client.getRule(rule_id), extracts the first affected_item, maps fields (id, description, level, groups, filename, relative_dirname, status, compliance mappings, mitre, details), and returns JSON response. Returns error if rule not found or on exception.

  async ({ rule_id }) => {
    try {
      const response = await client.getRule(rule_id);
      const rules = response.data.affected_items;
  
      if (rules.length === 0) {
        return {
          content: [
            {
              type: "text" as const,
              text: JSON.stringify({ error: `Rule '${rule_id}' not found` }),
            },
          ],
          isError: true,
        };
      }
  
      const rule = rules[0];
      const result = {
        id: rule.id,
        description: rule.description,
        level: rule.level,
        groups: rule.groups,
        filename: rule.filename,
        relative_dirname: rule.relative_dirname,
        status: rule.status,
        pci_dss: rule.pci_dss,
        gdpr: rule.gdpr,
        gpg13: rule.gpg13,
        hipaa: rule.hipaa,
        nist_800_53: rule.nist_800_53,
        tsc: rule.tsc,
        mitre: rule.mitre,
        details: rule.details,
      };
  
      return {
        content: [{ type: "text" as const, text: JSON.stringify(result, null, 2) }],
      };
    } catch (error) {
      return {
        content: [
          {
            type: "text" as const,
            text: JSON.stringify({
              error: error instanceof Error ? error.message : String(error),
            }),
          },
        ],
        isError: true,
      };
    }
  }

• src/tools/rules.ts:93-98 (schema)

  Zod schema for the 'get_rule' tool input: 'rule_id' is a required integer (e.g., 5710).

  {
    rule_id: z
      .number()
      .int()
      .describe("Rule identifier (e.g., 5710)"),
  },

• src/client.ts:266-270 (helper)

  Client helper method getRule(): sends an HTTP GET request to the Wazuh API /rules endpoint with rule_ids query parameter.

  async getRule(
    ruleId: number
  ): Promise<WazuhApiResponse<WazuhPaginatedData<WazuhRule>>> {
    return this.get("/rules", { rule_ids: ruleId });
  }

• src/types.ts:113-133 (helper)

  TypeScript interface for WazuhRule, defining the shape of rule data returned by the API and used by the handler.

  export interface WazuhRule {
    id: number;
    description: string;
    level: number;
    groups?: string[];
    pci_dss?: string[];
    gdpr?: string[];
    gpg13?: string[];
    hipaa?: string[];
    nist_800_53?: string[];
    tsc?: string[];
    mitre?: {
      id?: string[];
      tactic?: string[];
      technique?: string[];
    };
    details?: Record<string, unknown>;
    filename?: string;
    relative_dirname?: string;
    status?: string;
  }