{"uid":"cap_qouXeL1F8sfPsf7ZjXJ74","slug":"atk-wazuh-rule-audit-11f381e5","name":"ATK Wazuh Rule Audit","description":"Full Wazuh custom-rule load audit: every rule that passes wazuh-analysisd -t but is dropped at load, with the fix.","url":"https://atkvn.com/agent/v1/wazuh-audit?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"files":{"type":"array","items":{"type":"object","required":["filename","xml"],"properties":{"xml":{"type":"string","description":"Rule file content"},"filename":{"type":"string","description":"File name as in /var/ossec/etc/rules/, e.g. 0094-local.xml"}}},"maxItems":20},"wazuh_version":{"enum":["4.14.7","4.14.9"],"type":"string"}}},"responseSchema":{"type":"json","example":{"errors":1,"findings":[{"file":"0094-local.xml","rule":"100100","issue":"Parent 5715 lives in 0095-sshd_rules.xml, which sorts after 0094-local.xml ... Rename the file so it sorts after 0095-sshd_rules.xml.","severity":"error"}],"rules_checked":1}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.05","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.05/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_KQFpg846oLi9X7Vs-sB0a","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.05","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Validates Wazuh SIEM rule XML files for correctness, parent-rule ordering issues, and configuration errors before deployment","exampleAgentPrompt":"Can you audit my Wazuh 4.14.9 rule file — it's called 0094-local.xml and contains my custom SSH detection rules — and tell me if there are any ordering issues or errors I need to fix before I deploy it?","exampleUseCases":[{"title":"Pre-deployment rule validation","prompt":"Before I push these custom Wazuh rules to production, can you check my 0094-local.xml file for any errors or parent-rule ordering problems? I'm running Wazuh 4.14.9."},{"title":"CI/CD pipeline rule linting","prompt":"I want to automatically validate all our Wazuh rule XML files in our deployment pipeline — can you audit these three rule files (0100-custom.xml, 0101-app.xml, 0102-network.xml) against Wazuh 4.14.7 and flag anything that would cause a load failure?"},{"title":"Debugging broken Wazuh rules","prompt":"My Wazuh manager is rejecting my local rule file and I'm not sure why — can you audit 0094-local.xml for me and explain what's wrong? We're on Wazuh 4.14.9."}],"resultDescription":"A JSON object containing the total error count, the number of rules checked, and a list of findings — each with the affected filename, rule ID, a human-readable issue description, and a severity level (e.g. error, warning). Helps pinpoint exactly which rule has a problem and how to fix it.","failureModes":["Invalid XML syntax in the rule file causes a parse error finding","Referencing a parent rule ID that doesn't exist or sorts after the child file results in an ordering error finding","Submitting more than 20 files at once is rejected by the schema limit","Unsupported Wazuh version strings outside the allowed enum return a validation error","Empty or malformed request body returns a 4xx HTTP error"],"whenToPreferThis":"Use this endpoint when you need to validate Wazuh/OSSEC SIEM rule XML files specifically — particularly for detecting parent-rule ordering issues that only manifest at load time. Prefer this over generic XML validators because it understands Wazuh's rule inheritance model, file-sort-order semantics, and version-specific behavior for 4.14.x. Ideal for CI/CD pipelines, pre-deployment checks, or debugging mysterious Wazuh rule load failures.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-28T06:37:34.037Z","isFirstParty":false,"canonicalSlug":"atk-wazuh-rule-audit-11f381e5"}