S
Oct 6, 2026Sophos Firewall logs and Wazuh: the newer syslog layout matches no decoder
Sophos Firewall can send syslog in two layouts. Wazuh 4.14.7 reads one of them. If your firewall uses...
Oct 6, 20263 min read0 reactions0 comments
Back to articles
Tag archive
#wazuh
F
Oct 5, 2026FortiGate denied traffic never reaches the Wazuh dashboard. Rule 81618 is level 1.
FortiGate sends its logs to Wazuh, failed admin logins show up, and denied traffic does not. On Wazuh...
Oct 5, 20262 min read0 reactions0 comments
A
Oct 4, 2026A single pfSense block never becomes a Wazuh alert. Here is why, measured.
You point pfSense at Wazuh, the logs arrive, and the dashboard stays empty. Most people assume the...
Oct 4, 20263 min read0 reactions0 comments
W
Oct 3, 2026Wazuh 5.0 will not load your custom XML rules. 82% of one public pack depends on what it drops.
If you run Wazuh 4.x with your own rules and decoders, the 5.0 release changes more than the version...
Oct 3, 20263 min read0 reactions0 comments
w
Oct 2, 2026wazuh-analysisd shows at most 50 load warnings. The rest of your ignored rules are silent.
If you load a large set of custom Wazuh rules, wazuh-analysisd -t and ossec.log can tell you that...
Oct 2, 20263 min read1 reactions0 comments
T
Oct 1, 2026Three reasons a custom Wazuh rule stays silent after a clean config check, measured on 4.14.7
A custom Wazuh rule that never fires rarely has a broken regex. In our lab the usual story is...
Oct 1, 20265 min read0 reactions0 comments
W
Sep 30, 2026Wazuh: 17,587 Fingerprint Matches on the Security Platform Watching Everything
A ZoomEye fingerprint count of internet-visible Wazuh deployments, why a security platform concentrates estate knowledge and detection logic, and which of its surfaces belong on the internal network.
Sep 30, 20263 min read0 reactions0 comments
O
Sep 28, 2026OSSEC vs Wazuh: FIM and Active Response Compared
OSSEC vs Wazuh: File Integrity Monitoring and Active Response OSSEC and Wazuh share...
Sep 28, 20263 min read0 reactions0 comments
W
Sep 28, 2026Wazuh loses events three ways under load, and only one of them raises an alert
A question we got on LinkedIn: one Wazuh agent reads the logs of 1,600 firewalls, the dashboard shows...
Sep 28, 20263 min read0 reactions3 comments
O
Sep 24, 2026One field path, two shapes: how Wazuh alerts get dropped with a 400 nobody sees
In the last 24 hours, two people running Wazuh 4.14.7 in production hit the same defect from...
Sep 24, 20262 min read0 reactions0 comments
W
Sep 26, 2026Wazuh custom rule never fires, and analysisd -t still exits 0: the file name decides
You write a child rule for a stock Wazuh rule, drop it into /var/ossec/etc/rules/, and run the config...
Sep 26, 20263 min read1 reactions0 comments
W
Sep 26, 2026Wazuh ms-graph: why Entra ID sign-ins never reach the indexer, and a one-processor fix
You enable the Wazuh ms-graph module for auditLogs/signIns. The module logs clean scans. With...
Sep 26, 20267 min read1 reactions0 comments