Tools · Endpoint visibility · 24 / 25
Wazuh: the rule id is not the level
rule.id is which rule matched. rule.level is the number that rule carries. They are different fields. Write both, and do not look up rule 12 when the level is 12 and the id is something else.
The id names the rule
rule.id is the identifier of the rule that matched. That is the rule you open in the ruleset. A different number is a different rule, even when it sits next to a familiar level.
If the id is missing, write “rule id not on this alert.” Do not use the level as the id.
The level is the number on that rule
rule.level is the number stored on the rule that matched. It explains why the event was kept as an alert. It is not a second rule id, and it is not a count of alerts.
Two rules can carry the same level. The level does not tell you which of them fired.
What to file
File rule.id and rule.level with their names. When you say “rule 100211,” that must be the id. When you say “level 12,” that must be the level. Do not drop the words.
Worked case: level 12 opened as rule 12
A lab alert shows rule.id 100211 and rule.level 12. A draft looks up rule 12 in the local rules file, finds a different check, and describes that check as what fired.
The note quotes id 100211 and level 12 as separate fields. Rule 12 was the wrong lookup. The description in the ticket has to match 100211, not the file opened by mistake.
rule.id: 100211 rule.level: 12 looked up by mistake: rule 12 write: id 100211, level 12 not: rule 12 fired
Diagram
The rule id and the level number
They are printed close together and answer different questions.
Is. Which rule matched
Example. 100211
Use. When you open the rule
Is. The number that rule carries
Example. 12
Does not. Select a different rule file
Check yourself
1. An alert shows rule.id 100211 and rule.level 12. Which rule matched?
2. Why is opening rule 12 the wrong file?
3. The alert paste has a level and no id. What do you write?