{"uid":"cap_eLMbi6hcCSyqOw0URDNre","slug":"atk-wazuh-testfire-rule-decoder-validation-engine-a0305aea","name":"ATK Wazuh TestFire — Rule & Decoder Validation Engine","description":"Run your Wazuh rules and decoders on a real wazuh-manager 4.14.9 against up to 10 log lines: did your rule fire, decoded fields, full alert, load warnings.","url":"https://atkvn.com/agent/v1/wazuh-testfire?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"logs":{"type":"array","items":{"type":"string"},"maxItems":10,"minItems":1,"description":"Raw log lines, one event each"},"rules":{"type":"array","items":{"type":"object","required":["filename","xml"],"properties":{"xml":{"type":"string"},"filename":{"type":"string"}}},"maxItems":10},"decoders":{"type":"array","items":{"type":"object","required":["filename","xml"],"properties":{"xml":{"type":"string"},"filename":{"type":"string"}}},"maxItems":5},"log_format":{"type":"string","default":"syslog"},"wazuh_version":{"enum":["4.14.9"],"type":"string"}}},"responseSchema":{"type":"json","example":{"events":[{"alert":true,"decoder":"sshd","rule_id":"100100","rule_level":10,"your_rule_fired":true}],"load_warnings":[],"your_rules_never_matched":[],"your_rules_dropped_at_load":[]}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.008","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.008/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.008","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.008","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_MZrbd2VDI7bTdyyiN47bR","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.008","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Submits raw log lines against custom Wazuh detection rules and decoders to verify which rules fire, at what level, and whether any rules are dropped or never matched","exampleAgentPrompt":"I need to check whether my custom Wazuh rule fires correctly — here are 3 syslog lines from an SSH brute-force attempt and the XML rule file I wrote; run them through the Wazuh 4.14.9 engine and tell me which rule IDs triggered, at what level, and whether any rules were dropped or never matched.","exampleUseCases":[{"title":"Pre-deployment detection rule smoke test","prompt":"Before I push this new Wazuh XML rule to production, run these 5 sample auth failure log lines through it using Wazuh 4.14.9 in syslog format and confirm the rule fires at level 10 with the right rule ID — and flag anything that gets dropped at load."},{"title":"Custom decoder validation for proprietary app logs","prompt":"I wrote a custom Wazuh decoder to parse our app's JSON-ish log format — can you run these 4 sample log lines through it along with the decoder XML and tell me if the decoder is correctly identified and the fields are being extracted properly?"},{"title":"Regression test for updated detection logic","prompt":"I just modified my Wazuh SSH rule XML and want to make sure it still catches the same events — run these 8 syslog entries through both my updated rule and decoder using Wazuh 4.14.9 and show me which alerts fired, which rules matched, and whether anything regressed compared to what I'd expect."}],"resultDescription":"A JSON object containing an events array where each log line result includes whether an alert was triggered, the matched decoder name, the firing rule ID and level, and a flag for whether the user's specific rule fired. Also includes arrays of load warnings, rules that never matched any log, and rules that were dropped during loading — giving a complete picture of rule efficacy and correctness.","failureModes":["Malformed XML in rule or decoder causes the rule to appear in 'your_rules_dropped_at_load' rather than returning an error","Log lines that don't match any decoder result in no alert and empty decoder field","Rules referencing undefined groups or fields silently fail to match","Sending more than 10 log lines or 10 rules exceeds schema limits and will be rejected","Specifying an unsupported Wazuh version (anything other than 4.14.9) returns a validation error","Empty or whitespace-only log lines may produce unexpected decoder behavior"],"whenToPreferThis":"Choose this endpoint when you need to validate custom Wazuh SIEM rules and decoders against real or synthetic log data before deploying to a live environment. It is specifically designed for Wazuh rule XML syntax and the Wazuh 4.14.9 engine — not generic regex testing or other SIEM platforms like Splunk or Elastic. Prefer this over standing up a test Wazuh instance when you need fast, repeatable, pay-per-call rule validation in an automated pipeline or CI workflow.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-28T06:32:55.848Z","isFirstParty":false,"canonicalSlug":"atk-wazuh-testfire-rule-decoder-validation-engine-a0305aea"}