Wazuh: rule.level is the rule’s number, not the incident

The object is a rule match

When the manager writes an object to alerts.json, a rule’s conditions were true for one event. rule.id is which rule. rule.level is the number that rule carries, which is why the event was stored as an alert instead of being dropped below the threshold. rule.description is the template string from the rule, with fields filled in.

None of those three is a person’s decision that something unwanted happened. A local rule can set a high level on a path you simply want to notice. Quote the id and the level as properties of the rule.

Which event fields were actually filled

For a file-integrity alert, syscheck.path and the change type are the event. User and process fields appear when the agent was able to attribute the change. If those fields are absent, the alert does not say the change was unattended, and it does not say who did it. Write “attribution not in this alert” rather than a guess.

A technique id copied into the rule is the author’s tag. It is not a second measurement. Cite it only as a tag on that rule id.

What the note needs before anyone is paged

The note carries the timestamp, agent name, agent id, rule id, level, path, change type, and a yes or no for attribution fields. Then it says whether a change ticket already covers that path and that window. The level explains why the object exists. The ticket, or the lack of one, is what a person uses to close or escalate.

Worked case: level 12 and no user field

lab-web-02 produces an alert for rule 100211 at level 12. The description reads “ssh config changed on lab-web-02.” syscheck.path is /etc/ssh/sshd_config and the change type is modified. There is no audit user and no process name, because that directory was watched without attribution. A draft pages on-call for an unknown person changing SSH.

The note quotes rule 100211, level 12, the path, the timestamp, and “attribution not in this alert.” The level is why it was written down. The on-call page waits until someone compares the change with the maintenance ticket. If the ticket covers it, the alert closes with the ticket number. If it does not, the missing user is recorded as a gap, not as a named intruder.

time: 2026-11-03T18:05:44Z
agent: lab-web-02  id: 014
rule.id: 100211  rule.level: 12
path: /etc/ssh/sshd_config  change: modified
attribution: not in this alert
description: template text from the rule, not a verdict