implementing-endpoint-detection-with-wazuh

What problem does it solve?

Setting up endpoint detection with Wazuh involves many failure points: agents that register but never connect, custom decoders and rules that silently never fire, and active responses that fail without errors. This Skill provides a structured workflow for deploying Wazuh SIEM/XDR, managing agents, writing custom detection logic, and verifying alerts end to end.

Core Features & Use Cases

• Agent Management via REST API: Authenticate with JWT, list agents, and monitor connection status, versions, and keep-alives through the /agents endpoint.
• Custom Decoder and Rule Creation: Write organization-specific decoder and rule XML in local_rules.xml with correct ID ranges (100000-120000) and severity levels.
• Alert Querying and Rule Validation: Search alerts by rule ID, severity, agent, or time range, and validate detection logic with the /logtest endpoint before deployment.
• Use Case: A security team deploys Wazuh across their fleet, writes a custom rule to detect suspicious SSH login patterns, validates it with logtest against sample log lines, and confirms the alert appears in the wazuh-alerts-* index.

Quick Start

Use the Wazuh endpoint detection skill to authenticate to my Wazuh manager API, list all disconnected agents, and test my custom rule in local_rules.xml against a sample log line.