Rules¶

Rules are YAML files that define what to query, and under what condition an alert should fire.

Rule file format¶

id: "001"
name: Brute Force Detected
level: 65
size: ">5"
active: true
author:
    - Your Name <[email protected]>
group: authentication
tags:
    - authentication_failed
    - bruteforce
description: "More than 5 failed login attempts in the last minute"
rule: |-
    SELECT count(*) AS cnt
    FROM auth_logs
    WHERE
        timestamp >= now() - INTERVAL 1 MINUTE
        AND tenant = '{{ detector.tenant }}'

Fields¶

Severity levels¶

level is an integer between 0 and 100. Anything outside that range makes the rule fail to load.

Webhooks translate the level into the severity vocabulary of their destination using these bands, where each band starts at the level below and ends where the next one begins:

The bands are configurable per webhook with the severity_map option, which takes the minimum rule level of each band. Bands left out keep their default:

webhooks:
    my_hook:
        type: opsgenie
        api_key: '...'
        severity_map: # optional, only the bands you want to move
            high: 70
            critical: 90

Each webhook page documents how it maps the bands to its destination.

Sigma rules use a textual level, which is converted on load:

size — condition format¶

The size field compares the number of rows returned by the query against a threshold.

Jinja2 templates¶

The rule query is rendered with Jinja2 before execution. The following variables are available:

Custom Jinja2 filters¶

Example with template variables¶

rule: |-
    SELECT user, count(*) AS attempts
    FROM auth_logs
    WHERE
        tenant = '{{ detector.tenant }}'
        AND status = 'failed'
        AND timestamp >= now() - INTERVAL 5 MINUTE
    GROUP BY user
    HAVING attempts > {{ rule.data.threshold | default(5) }}
data:
    threshold: 10

Loading rules in a detector¶

Rules are referenced in the detector's rules list. Both direct paths and glob patterns are supported:

detectors:
    my_detector:
        rules:
            - "rules/auth/brute_force.yml"
            - "rules/network/*.yml"
            - "rules/**/*.yml"

Webhook alert template variables¶

When a rule fires and a webhook is called, the following variables are available in the webhook template:

Tips¶

For more precise query results, use the {{ startime }} and {{ endtime }} parameters. These allow you to filter data within a specific time range, making your queries more efficient and relevant

SELECT
    rule_id,
    rule_description,
    rule_groups
FROM wazuh_alerts
WHERE
    timestamp >= fromUnixTimestamp({{ startime }})
    AND timestamp <= fromUnixTimestamp({{ endtime }});