WAZGEN

Generate

Paste log · ZIP pack · workspace · Ctrl+Enter · Ctrl+K

Try
More options
MITRE (optional)

Output appears here

Paste a log, or try a sample.

Recent rules
Empty. History stays in this browser only.

Patterns

Pick a sample → auto-generate

Workspace

Collect rules, export one ZIP for the manager

Ruleset

Deploy

From generated XML to a live Wazuh alert

Saved in this browser. Injected into agent install scripts.

  1. 1

    Generate rule

    On Generate, copy or Download pack (rule + decoder + ossec snippet).

  2. 2

    Install Wazuh (if needed)

    Server first, then agent on each host.

    Server 
    Loading…
    Agent 
    Loading…
  3. 3

    Drop rule on manager

    Save XML as local_rules.xml, then run:

    sudo cp local_rules.xml /var/ossec/etc/rules/
sudo chown root:wazuh /var/ossec/etc/rules/local_rules.xml
sudo chmod 640 /var/ossec/etc/rules/local_rules.xml
echo 'your log here' | /var/ossec/bin/wazuh-logtest
sudo systemctl restart wazuh-manager