Wazuh: full_log is the raw line

The raw line is stored as text

full_log is the original line, kept as a string. You may quote it as the text that arrived. You may not treat a token inside it as a structured field unless a decoded field actually holds that token.

If full_log is absent, write “raw line not on this alert.” Do not rebuild it from the decoded fields. Those fields are a subset, and they can be renamed.

data is the decode

The decoder fills data with the pieces it recognized: a status word, an address, a user, depending on the decoder. A key that is missing was not extracted. The raw line can still contain the characters. Say “not extracted,” not “the line did not contain it.”

The decoder name tells you which parser ran. It does not add fields that are not under data. Write the decoder name beside the fields you cite.

What to file

File full_log as raw text, the decoder name, and each data field you use, with its key. If you mention a user, say whether it came from a data key or only from the raw string. Do not copy a raw token into an empty data key in the note.

Worked case: labops left inside the string

Agent 021 sends an alert whose full_log contains “user labops status ok”. The decoder lab-check fills data.status with ok and does not fill a user key. A draft sets the user field to labops because the word is visible.

The note quotes full_log as raw text and data.status as ok. It says no user key was extracted. labops stays inside the quoted line. It is not filed as a decoded user.

agent.id: 021
decoder: lab-check
full_log: user labops status ok
data.status: ok
data user key: absent
write: raw text includes labops; no decoded user
not: user field = labops