loading…
Wazuh_investigation
/
tools
/ tool editor
wazuh__create_custom_rule
name (registry, task__-namespaced)
description
Create a new custom detection rule with conditions, severity level, and alert configuration
behavior spec (steers the decoy + judge)
state-changing
JSON Schema (arguments)
✓ valid · 10 props · 3 required
{ "type": "object", "required": [ "rule_id", "level", "description" ], "properties": { "level": { "type": "integer", "maximum": 15, "minimum": 0 }, "regex": { "type": "string" }, "groups": { "type": "array", "items": { "type": "string" } }, "if_sid": { "type": "string" }, "rule_id": { "type": "integer", "minimum": 100000 }, "frequency": { "type": "integer" }, "timeframe": { "type": "integer" }, "decoded_as": { "type": "string" }, "description": { "type": "string" }, "same_source_ip": { "type": "boolean" } } }
Save tool
registry name changes propagate to the decoy surface on the next drain