Custom Alert Rules in Wazuh

Walkthrough summary

Custom Alert Rules in Wazuh TryHackMe walkthrough with 10 answered prompts and lab methodology notes.

Sample prompts covered

• Looking at the Sysmon Log, what will the value of sysmon.commandLine be?
  Open the walkthrough page to inspect the full answer and command flow.
• What would the extracted value be if the regex is set to "User: \S*"?
  Open the walkthrough page to inspect the full answer and command flow.
• From the Ruleset Test results, what is the ID of rule id 184666?
  Open the walkthrough page to inspect the full answer and command flow.
• According to the Wazuh documentation, what is the description of the rule with a classification level of 12?
  Open the walkthrough page to inspect the full answer and command flow.
• In the Ruleset Test page, change the value of "sysmon.image" to "taskhost.exe', and press the "Test" button again. What is the ID of the rule that will get triggered?
  Open the walkthrough page to inspect the full answer and command flow.