Wazuh in this project is a lab SIEM: agent on the endpoint, manager, index, dashboard. On one hypervisor they often sit together. This is not an enterprise rollout (clusters, multi-tenant, 90-day retention SLA).
Chain
host event → agent → decoder / rule → alert → analyst
If you cannot point to which hop failed, do not add another rule.
Practical check order:
- does the log even exist on the host (Event Viewer /
journalctl) - does the agent send it (agent connected, no silence in
ossec.log) - did the decoder keep the fields the rule uses
- does the alert share time and host with the log
- can you close it as FP with a reason
Practise first
- a Windows log and a Linux log visible in the manager
- one rule with a positive test — template in Resources
- an alert you can replay with the same command
Do not dump an “enterprise” ruleset into the lab on day one. An empty field in the template means do not enable.
Wider SIEM context: Wazuh as a starting point. Lab portfolio: Wazuh SIEM.