Wazuh as a starting point for SIEM

Wazuh in the lab exists so you can see how an alert is born, not so you can pretend it is an enterprise platform.

Before you write a clever rule, answer:

1. where the log comes from
2. how it reaches the manager
3. what survives the decoder
4. when an alert fires
5. what the analyst sees
6. how to replay it or close it as FP

SIEM does not replace triage. The rule-review template is in Resources — an empty field means “do not enable”.