# wazuh-custom-rules

Companion files for the lesson **Write Custom Wazuh Detection Rules (Sigma YAML)**:
<https://maheshtata.com/wazuh/wazuh-custom-rules/>

Tested against: Wazuh 5.0 (beta5 documentation, September 2026), Ubuntu 24.04.
Wazuh 5.0 is in beta. Re-check every asset against the release documentation at GA.

This rule matches the fields produced by the decoders in
[`../wazuh-custom-decoder`](../wazuh-custom-decoder). Build those first.

| File | What it is |
| --- | --- |
| `rule-portal-admin-auth-failure.yml` | The rule as you paste it into the YAML editor at Security Analytics > Detection > Rules. |
| `rule-portal-admin-auth-failure.request.json` | The same rule wrapped in the `{integration, resource}` envelope that `POST /_plugins/_content_manager/rules` expects. |
| `logtest-detection.json` | A sample event that should match. |
| `logtest-detection-negative.json` | A sample event that should not match, because the role is not `admin` and the source address is inside a filtered range. |

Replace `REPLACE_WITH_PORTAL_AUDIT_INTEGRATION_UUID` in both request files with the
integration UUID the indexer returned when you created the integration.

## Order of operations

1. Create the rule in the **draft** space, linked to the `portal-audit` integration.
2. Promote draft to **test**.
3. Run both Log test bodies. The positive one should report a match, the negative one none.
4. Promote test to **custom**.
5. Create a detector over `wazuh-events-v5-access-management` that selects this rule.

## What this rule deliberately does not do

It does not count failures over a time window. Wazuh 5.0 rules have no `frequency`,
`timeframe`, `same_*` or `if_matched_sid` equivalent, and the migration guide states
plainly that correlation is handled outside the rule format. Rate logic belongs in an
OpenSearch Alerting monitor on `wazuh-findings-v5-access-management*` or in a Security
Analytics correlation rule.