# Root decoder for the custom integration.
#
# This is the root decoder published in the Wazuh 5.0-beta documentation
# ("Create a security analytics detection workflow"), reproduced verbatim
# apart from the metadata dates and the id, which the Content Manager
# generates if you omit it.
#
# Every integration needs a root decoder attached to it before any child
# decoder will run. It parses the raw event as JSON into a temporary field
# (_tmp_json) that child decoders read.
#
# Source: https://documentation.wazuh.com/5.0-beta/user-manual/data-analysis/detection-workflow.html
---
name: "decoder/core-wazuh-message/0"
id: "cfcec70f-2ca6-455f-941f-34d2c5fc9628"
enabled: true
metadata:
  author: "Wazuh, Inc."
  date: "2026-06-10T19:32:11Z"
  description: "Base decoder to process Wazuh message format, parses location part\
    \ and enriches the events that comes from a Wazuh agent with the host information."
  documentation: ""
  modified: "2026-06-10T19:32:11Z"
  references:
  - "https://documentation.wazuh.com/"
  supports: []
  title: "Wazuh message decoder"
normalize:
- map:
  - _tmp_json: "parse_json($event.original)"