Wazuh: location is the path the agent reported

Location is where the agent said the event came from

An alert’s location is the path or channel the agent attached, such as a log file path on that endpoint. It tells you which source the agent was reading. It does not mean the manager has that path on its own disk, and it does not mean you should open that path on your laptop.

The agent id says which enrollment reported it. The same path string on two agent ids is two reports. Do not merge them because the path text matches.

The path is not the hostname

A path can contain a directory that looks like a project name. That is still a path. The agent name is a different field. If you say “the host,” use the agent id and the agent name, and use location only for the source path.

If location is empty, write “location not on this alert.” Do not copy the agent name into that field.

What to file

File agent id, agent name, location, and the rule id. Say that location is the reported path. If you did not open the file on the endpoint, do not describe its contents beyond what the alert already quoted.

Worked case: a manager path that was never there

An alert for agent 014, name lab-web-02, has location /var/log/auth.log. A draft tells a teammate to open /var/log/auth.log on the Wazuh manager. The manager does not have the lab host’s auth log at that path. The line was reported by the agent.

The note says location is the path on the agent that reported it, agent 014. The file to read, if someone needs the raw line, is on that endpoint or in the alert’s stored event, not on the manager’s filesystem at the same string.

agent.id: 014  agent.name: lab-web-02
location: /var/log/auth.log
meaning: path the agent reported
not: a file on the manager at that path
not: the hostname