Analyst Tools
The all-in-one deployment places the Manager, Indexer, and Dashboard on one host. Custom rules and decoders belong under /var/ossec/etc/; custom integration executables belong under /var/ossec/integrations/, with their settings in ossec.conf. Wazuh-supplied rules and decoders live under /var/ossec/ruleset/ and may be replaced during upgrades. Preserve customizations and verify their supported locations before patching.
| Tool | Path / Command | What It Does |
|---|---|---|
| Wazuh Manager | /var/ossec/etc/ossec.conf |
The manager’s main settings file. Controls what it monitors, which agents may connect, and which integrations run. |
/var/ossec/etc/rules/local_rules.xml |
Your own detection rules. This is the file you edit; everything written in the detection labs lands here. | |
/var/ossec/etc/decoders/local_decoder.xml |
Teaches Wazuh to read log formats it doesn’t already understand so fields can be extracted. | |
/var/ossec/ruleset/rules/ |
The thousands of rules Wazuh ships with. Read them for reference; never edit — an upgrade overwrites this directory. | |
/var/ossec/ruleset/decoders/ |
Vendor-supplied decoders for common log sources. Same rule: read, don’t edit. | |
/var/ossec/logs/alerts/alerts.json |
Current JSON alert output, subject to configured alert level and output settings. Filebeat forwards these alerts to the indexer; older output may be rotated. | |
/var/ossec/logs/alerts/alerts.log |
The same alerts in readable block form. Easier to eyeball, harder to parse. | |
/var/ossec/logs/ossec.log |
The manager’s own diary. First place to look when something isn’t working. | |
/var/ossec/etc/client.keys |
The list of registered agents and their secrets. If an agent won’t connect, suspect its entry here. | |
/var/ossec/var/db/mitre.db |
A local copy of the ATT&CK catalog so alerts can carry technique IDs without internet access. | |
/var/ossec/bin/wazuh-control |
Starts, stops, and reports status for all Wazuh daemons at once. | |
/var/ossec/bin/agent_control |
Lists agents and their connection state from the command line. | |
/var/ossec/bin/wazuh-logtest |
Paste a raw log line and see which decoder and rule match it. Fastest way to test a rule you just wrote. | |
/var/ossec/queue/ |
Working storage for events in flight: FIM baselines, agent counters, buffered alerts. | |
/etc/wazuh-indexer/opensearch.yml |
Settings for the search database that stores alerts long term. | |
/etc/wazuh-dashboard/opensearch_dashboards.yml |
Settings for the web interface, including which indexer it talks to. | |
/etc/filebeat/filebeat.yml |
The shipper carrying alerts from manager to indexer. If alerts exist on disk but not in Discover, check here. | |
| MITRE ATT&CK | /var/ossec/var/db/mitre.db |
A local copy of the ATT&CK catalog shipped with Wazuh, so alerts can be tagged offline. |
local_rules.xml → <mitre><id>Tnnnn</id></mitre> |
How you attach a technique ID to a rule you wrote yourself. | |
Dashboard → Modules → MITRE ATT&CK |
The built-in view showing which techniques your environment has actually triggered. | |
rule.mitre.id |
The Discover field to search, e.g. T1110 for brute force. | |
rule.mitre.tactic |
The attacker’s goal, e.g. Credential Access. | |
rule.mitre.technique |
The named method, e.g. Brute Force. |
If alerts appear in /var/ossec/logs/alerts/alerts.json but not in the Dashboard’s Discover view, the failure is downstream of the Manager. Check Filebeat before touching a rule.